'Red team' exercises happen ethically all the time. You get permission from people in charge (of either a project or a company), you agree on the ground rules,

'Red team' exercises happen ethically all the time. You get permission from people in charge (of either a project or a company), you agree on the ground rules, and then you do the exercise. They don't have to tell everyone in the group, but you have to tell certain key people and get their buy in.