Overview
Red teaming suits US organizations whose basic hygiene is already in good shape and who want to test their SOC, incident response and executive escalation under realiztic pressure. Published 2026 US price guides put red team engagements at roughly $30,000 to $150,000 or more. We agree objectives, rules of engagement and legal authorization in writing before any activity starts.
Penetration tests find vulnerabilities. Red team engagements answer a different question: if a capable adversary targeted us, would we notice — and how quickly could we respond?
We agree crown-jewel objectives with a small white team, then pursue them using realiztic techniques across people, process and technology while avoiding detection. The outcome is a clear narrative of the attack, every point where your defenses did or didn't respond, and a prioritized plan to close detection gaps.
For teams building or maturing a SOC, our purple team option runs techniques collaboratively with your defenders so every gap becomes an immediate detection improvement.
How testing works for US organizations
- Signed scope and written authorization before any testing, including hosting and cloud provider permissions
- Testing windows agreed around your US time zone at scoping, including after-hours windows for production
- Fully remote delivery, with internal and wireless access via VPN or a shipped test device, so no travel costs
- Reports mapped to SOC 2, PCI DSS, HIPAA and customer questionnaires, with a fixed price in USD
What's included
Our approach
- Objectives & rules of engagementCrown jewels, constraints, legal authorization and white-team escalation.
- Threat modelingAdversary profiles relevant to your sector and geography.
- Campaign executionMulti-week operation with continuous white-team communication.
- Detection analysisCorrelation of our activity with your logs and alerts.
- Debrief & purple workshopJoint replay with defenders and a detection improvement roadmap.
What you receive
- Executive attack narrative
- MITRE ATT&CK technique heat map
- Detection and response timeline
- Prioritized detection engineering backlog
- Optional purple team workshop
Standards & frameworks
- MITRE ATT&CK
- TIBER-EU style methodology
- NIST CSF 2.0
- DORA TLPT (where applicable)
- PCI DSS 11.4
Frequently asked questions
Are we ready for a red team?
You get the most value once you run regular penetration tests, have centralized logging and someone monitoring alerts. If not, we will recommend starting with penetration testing or a purple team.
How long does an engagement take?
Typically four to twelve weeks including planning, execution and reporting.
Will the red team disrupt the business?
No. We operate under strict rules of engagement, avoid destructive actions, and the white team can pause activity at any time.
Are you a PCI QSA or ASV, FedRAMP 3PAO or CMMC C3PAO?
No. We don't claim any of those statuses on this site. Most penetration tests for SOC 2, HIPAA, PCI DSS Requirement 11.4, the FTC Safeguards Rule and customer due diligence don't require them. If your contract, assessor or program requires a specific accredited provider, tell us at scoping and we'll say plainly whether we can meet it. See US compliance requirements.
Do you quote in US dollars?
Yes. US proposals are fixed-price and quoted in USD, with scope, effort, deliverables and payment terms set out in writing before work starts. See our US pricing guide for published market ranges.