A key part of our process is defining structured risk categories before testing begins. Without clear classification, red teaming becomes noisy and inconsistent. We group risks into areas like prompt injection, data leakage, harmful output generation, tool misuse, instruction confusion, and context manipulation. This ensures that every test maps back to a specific failure mode and can be systematically analyzed.