> I'm not sure if Google even has an internal red team, last time I talked with someone there they didn't (was 18 months ago though).

2012: Google staffs up ‘Red Team’

And this was literally just a Google away: https://nakedsecurity.sophos.com/2012/08/24/google-red-team-...

Red team is an overloaded term: "Analyze software and services from a privacy perspective, ensuring they are in line with Google's stated privacy policies, practices, and the expectations of our users." Doesn't sound like adversary simulation to me.

Yeah, still not the same as actually performing breaches themselves to see how long it takes to compromise, and if they get detected and how long it takes to remediate and evict the adversary. I should have been a bit clearer with what I meant initially.

How do you know there isn’t a team at Google doing this? It’s standard practice at companies of even middling size and Google is so large your friend might just be unaware of it.

A Google security manager told me at a conference when chatting about this in 2016. They were thinking of staffing a breach team, but did not have one then.

I thought Project Zero tries to find vulnerabilities in Google stuff too?

Project Zero is different compared to performing end to end breaches. A breach team might use 0-days of Project Zero to actually compromise Google's internal assets to see if their defenders can detect an adversary. FB has such a team and they gave public presentations (one was at RuxCon 2016) how they compromise for instance their domain controllers and stuff.

Google has a gaggle of security teams, almost all of which occasionally red team and some of which exclusively do. I'm not sure who told you otherwise but they were certainly mistaken. Source: I TL'd a security team there several years ago.

Thanks for pointing this out. I heard it from a security manager at Google at a conference in 2016. Good to hear that they do breach simulations now, besides regular pen testing and stuff.

I'm not sure if there was miscommunication or what, but Google has had teams that do this for a while now. I typically hear them referred to as orange teams.

I worked in 2014-2015 at Google on one of the (many) teams that did exactly that.