Let the red team loose on a copy of prod

The red team wants to attack production. Production would like to keep serving customers.

You POST /copy the production container into a redteam project with source_snapshot set to last night's 02:00 snapshot, copy_network_rules left false, and then set the copy's network exit to block. Same disk, same secrets, same misconfigurations, no route out. The red team gets a terminal URL and three days.

They find the unpatched library and the world-readable token file. They write it up against the copy. You patch the real container, snapshot it, and delete the target.

Staging never has the real data, and real data is where the findings are. The attack target is last night's production, and production never knows.

The attack target is last night's production, and production never knows.