Adversary simulationRed teaming
Red Team Services: Objective-Based Attack Simulation
Red teaming is an objective-based attack simulation: senior pentesters play a real adversary against objectives you choose, across perimeter, network, cloud and applications.
Key facts
- Price
- From $15,000
- Aligned with
- MITRE ATT&CK
- Testers
- OSCP, OSCE, CISSP certified
- Contract
- NDA on request · professional indemnity insurance
Priced in tester-days NDA on request Retest available after fixes How the test works See a sample report
Our senior pentesters play a real adversary against objectives you choose, across your perimeter, internal network, cloud and applications, to test whether your defenses hold as a chain.
What a red team engagement covers
- Objectives agreed with you, not a vulnerability checklist
- External, internal, cloud and identity attack paths
- Optional phishing, vishing and physical testing
- Tests detection and response, not just exposure
- Work aligned with MITRE ATT&CK, purple team replay on request
Fixed scope, fixed tester-days, fixed price, agreed before testing starts. Scoped and quoted per engagement. Priced in tester-days, no hidden fees.
Red team services are authorized, objective-based attack simulations that test whether your people, processes and technology can detect and stop a determined attacker, not just which vulnerabilities exist. Pentestica runs red team engagements for organizations that already test their systems regularly and now need to know how far a real adversary would get, with pricing from $15,000.
Last updated: October 28, 2026
Key takeaways
- A red team works toward objectives agreed in advance, such as reaching a payment system or a domain admin account, while your defenders aren’t told when or how.
- Scope can cover the perimeter, internal network, cloud, applications and, optionally, phishing, vishing and physical testing.
- It tests detection and response together with exposure, which is what separates it from a pentest.
- Red teaming at Pentestica starts from $15,000, priced in tester-days with no hidden fees. A retest is available after fixes.
- We aren’t a threat intelligence provider and hold no TLPT accreditation.
From $15,000
Red teaming priced in tester-days with no hidden fees, scoped with you before testing.
NDA and insurance
We sign an NDA before testing and carry professional indemnity insurance.
25 senior pentesters
A certified team (OSCP, OSCE, CISSP) with 500+ executed penetration tests.
Retest available
A retest is available after fixes. Whether it’s included depends on the engagement.
What are red team services?
Red team services are engagements in which offensive security specialists play the role of a real attacker against your organization, with a goal agreed in advance and no warning to your defenders about timing or methods. The result shows whether an attack path to that goal works and whether anyone noticed it on the way.
A penetration test asks which weaknesses in a defined scope can be exploited. A red team asks a narrower, harder question: could an attacker reach this specific asset, and would we catch them? Testers chain whatever works, from an exposed service or a reused password to an over-permissive cloud role, or a convincing phone call if social engineering is in scope. Our red team work is aligned with MITRE ATT&CK, the public knowledge base of adversary tactics and techniques, so your defenders can map each step to their own detections.
Only a small control group on your side, agreed during scoping and including whoever can pause the test, knows it’s running. Everyone else, including the security operations team, sees the activity the way they’d see a real intrusion.
If your perimeter and key applications haven’t had a recent test, start with our penetration testing services: a red team would mostly rediscover the same open doors at a higher price.
Know which objectives you want tested?
Send us your objectives and the environments in scope, and get the tester-days, timeline and a fixed price in writing. Prefer to compare first? See our prices.
Pentest, red team or purple team: which do you need?
Choose a penetration test to find and fix as many weaknesses as possible in a defined scope, a red team to learn whether a goal-driven attacker gets caught, and a purple team when you want testers and defenders working side by side to improve detections.
| Aspect | Penetration test | Red team | Purple team |
|---|---|---|---|
| Main question | Which weaknesses in this scope can be exploited? | Can an attacker reach an agreed objective without being stopped? | Which attacker techniques do our detections catch, and how do we close the gaps? |
| Defenders informed | Usually yes | Only a small control group | Yes, they work alongside the testers |
| Coverage | Broad, within the agreed scope | Narrow and deep, along the paths that work | The techniques you choose to rehearse |
| Main output | Findings with evidence and remediation | Attack path, what was detected and missed, findings | Detection gaps and fixes agreed with your team |
| Typical length | 1 to 3 weeks of testing plus reporting | Longer, set during scoping | Agreed sessions, stand-alone or after a red team |
| Price at Pentestica | Web app or API: $2,500–$5,500 | From $15,000 | Quoted in tester-days after a scoping call |
Red team penetration testing isn’t a replacement for regular pentests. EU financial entities identified by their competent authority under DORA must also run threat-led penetration testing, a red team exercise built on threat intelligence with rules set by DORA Article 26. We cover how it differs on our threat-led penetration testing (TLPT) page.
What can a red team engagement include?
A red team engagement can include any path a real attacker would try against your objectives. You decide which are in scope and which are off-limits before testing starts.
External attack surface
Internet-facing services, forgotten subdomains, VPN and remote access portals: the ways in from outside. See external penetration testing.
Internal network and Active Directory
Once inside, testers look for the shortest route to privileged accounts: delegations, reused credentials, flat segmentation. See internal penetration testing.
Cloud and identity
Roles, keys and trust relationships in AWS, Azure or GCP, and the identity provider that ties them to your staff accounts. See cloud penetration testing.
Applications and APIs
Customer portals and APIs are often the first foothold or the final target, and business logic flaws count as much as technical ones. Related: web application penetration testing.
Social engineering (optional)
Phishing and vishing (phone pretexting) aimed at agreed groups of staff, under written rules on who may be contacted and what testers may ask for.
Physical testing (optional)
Attempts to enter agreed sites or reach network ports on premises, only with written authorization that names the locations and dates.
What we do in a red team engagement
- Objective-based red team engagements aligned with MITRE ATT&CK, across the external perimeter, internal network, Active Directory, cloud and applications.
- Purple team sessions after the red team, where testers replay techniques with your defenders.
- Acting as the external red team tester in a regulated threat-led test, subject to your DORA Article 27 assessment.
- An NDA before testing, professional indemnity insurance and a two-layer report.
What we don’t do
- We aren’t a threat intelligence provider. Objectives and scenarios are agreed with you during scoping; if you already work with a threat intelligence provider, we build the attack plan from its scenarios.
- We hold no TLPT accreditation and no CREST certification.
- We don’t run a SOC, threat hunting or incident response. We test how your defenders detect and respond; we don’t take over that role.
- We don’t run denial-of-service or load tests, and we don’t certify compliance with DORA, NIS2 or any other standard.
How does a red team engagement run?
1. Scoping and rules of engagement
We agree the objectives, what’s in and out of scope, which systems must not be disrupted, testing hours, the starting point (external only or an agreed foothold such as a standard user account) and who can pause the test. Our guide to penetration test scope shows what to prepare.
2. Reconnaissance and planning
Testers map what’s publicly visible about your organization and plan the paths most likely to reach each objective.
3. Initial access
Testers try the agreed ways in, from exposed services to phishing if it’s in scope, and note the attempts that are stopped along the way.
4. Moving toward the objective
From the first foothold, testers escalate privileges and move laterally toward the objective, keeping exploitation to what’s needed to prove impact.
5. Critical findings don't wait
If testers confirm a weakness that poses a direct, serious risk, your agreed contact gets a short note with the evidence and the most important fix right away, not in the final report.
6. Report, debrief and retest
You get the report and a debrief with the control group, with an optional purple team replay for your defenders. A retest is available after fixes.
What does a red team engagement show you?
A red team shows which attack paths actually reach your critical assets and where detection or response broke down along the way. Two patterns from red team exercises we’ve run, both without social engineering:
A less obvious connection between systems. In one exercise that started from the position of an external attacker, with no staff accounts and no social engineering, the first objective was a path from the public attack surface to a designated segment of the client’s infrastructure. The defenders stopped some attempts through network monitoring, but one less obvious connection between systems let the test continue. Afterwards the client changed its segmentation and the rules for communication between services.
An alert without a timely response. In another controlled exercise, the security team received an alert about unusual activity but didn’t classify it as part of an ongoing attack at first, so testers could keep going for a while. The gap wasn’t missing tools; it was alert triage and prioritization. The client changed its escalation rules and response procedures.
A vulnerability list wouldn’t capture either result on its own. A red team tests prevention, detection and response as one chain.
How do you tell a red team from a relabeled pentest?
Ask three questions before you sign: are objectives agreed in advance, does only a small control group know the test is running, and will the result show how far an attacker got toward each objective, not just a list of vulnerabilities? Ask for the rules of engagement and a sample report too. If the answers describe a scoped vulnerability hunt with your whole team informed, you’re buying a penetration test, which may be exactly what you need.
What you receive
Every engagement ends with a report in two layers, so management and engineers can each act on it:
- Executive Summary: the most important risks, the attack paths and their possible business consequences, for decision-makers.
- Technical Report: each finding with the conditions it depends on, evidence of exploitation, impact and step-by-step remediation, so your IT team can reproduce and fix it.
Before the report goes out, findings are re-verified for reproducibility and correct severity. You can check the format in our sample penetration test report.
What do red team services cost?
Red teaming at Pentestica starts from $15,000, priced in tester-days with no hidden fees. The quote depends on the number of objectives, the attack surfaces in scope, whether phishing, vishing or physical testing is included and how long the active phase runs.
Published US pricing guides quote $40,000–$150,000+ for red team engagements. For other test types, see our penetration testing cost benchmarks. A full DORA TLPT is quoted individually. All our published ranges are on the pricing page.
What can you check before you hire us?
Three things you can verify for yourself: what the report looks like, who does the testing, and how a real engagement went.
What does the report look like?
Every report opens with an executive summary for management, then one page per finding: severity and CVSS score, evidence of exploitation, business impact and step-by-step remediation. A retest is available after fixes, and the updated report shows which findings are closed. Browse our sample pentest report with every section explained.
Who tests your systems?
Senior pentesters from our team of 25, holding hands-on offensive security certifications such as OSCP and OSCE alongside CEH, CISA, CISM and CRISC.
Frequently asked questions
What's the difference between a red team and a blue team?
The red team plays the attacker; the blue team is your defense, the people and tools that monitor, detect and respond. In an engagement, your security operations staff are the blue team being tested.
What is a purple team assessment?
A purple team assessment puts both sides in the same room: testers run attacker techniques openly, defenders check what their tools saw, and together they close detection gaps. We run it stand-alone or after a red team, quoted in tester-days.
How long does a red team engagement take?
Length is set during scoping and depends on the objectives and the attack surfaces in scope. Red team engagements generally run longer than a standard penetration test, which typically takes 1 to 3 weeks of testing plus a few days for the report, because testers work toward a goal and try to stay unnoticed.
Will a red team disrupt our production systems?
The rules of engagement name the systems that must not be disrupted, the testing hours and who can pause the test. Testers keep exploitation to the minimum needed to prove impact, and we don’t run denial-of-service or load tests.
Do we have to include phishing or physical testing?
No. Social engineering and physical testing are optional and agreed in writing before testing. Many organizations keep the scope technical, starting from the external perimeter or an agreed foothold.
Can you act as the red team tester in a regulated test?
Yes, as the external red team tester, if your assessment under DORA Article 27 confirms we meet the tester requirements. We hold no TLPT accreditation and don’t supply threat intelligence. Scope and requirements are on our threat-led penetration testing (TLPT) page.
Is a retest included?
A retest is available after fixes. Whether it’s included in the price depends on the engagement and is agreed in the quote. The retest replays the original attack path and marks each finding as fixed, partially fixed or still present.
Fixed-price quote
Request a red team engagement
Tell us what to test. You get a written scope, the number of tester-days and a fixed price before any testing starts. No hidden fees.
See a sample report first (18-page PDF, no email required)
Red teaming from $15,000, priced in tester-days. All prices
What happens after you send it
- Tell us what to test Send the objectives you want tested, the environments in scope, whether phishing, vishing or physical testing is included, any off-limits systems and your deadline.
- Get a written scope and price We reply by email with scoping questions or a fixed quote in tester-days.
- Test, report, retest Red team timing is set during scoping, around your objectives. Critical findings are reported during testing. Retesting after fixes is available.
- OSCP, OSCE and CISSP certified testers
- 500+ penetration tests
- Aligned with MITRE ATT&CK
- Executive summary and technical report