They keep talking about red team and blue team—does this make any sense for an SME?

For a blue team to even exist, you need centralized log aggregation software and dedicated analysts actively monitoring it. In a 22-person company, logs probably only get looked at when something crashes. Testing a non-existent defense layer makes zero technical sense.

Did the firm that quoted you explain what they'd actually target during this exercise? Like, are they trying to sneak into your office dressed as couriers, or are they just scanning open cloud database ports and slapping a 'red team' label on it? Most of the time it's just regular testing wrapped in fancy jargon.

The buzzwords sound cool for sure, definitely gives that military-op vibe when presenting to the board. But selling a 14,500 Euro red team exercise to a 22-person logistics SaaS is like installing laser tripwires in a corner bodega instead of buying a sturdy cash box.

Last year we got a similar quote for our 30-person team, they wanted 12,000 Euro. We turned it down and just hired an independent expert for 3,200 Euro to do a penetration test on our cloud infrastructure and web panel. We patched the 4 critical vulnerabilities they found, and that was more than enough.

just ask for a web app pen test directly. honestly what they call red teaming for smbs usually doesn't go beyond sending fake emails to your staff and counting who clicked.

Since you handle customer data in the logistics industry, having an audit conducted is a sound decision. However, your budget allocation must be proportionate to your company's risk profile. A scoped technical penetration test alongside a review of your data retention procedures will adequately satisfy your legal and operational requirements.

The clear takeaway here is this: Red/blue team exercises are meant for massive enterprises with dedicated in-house defense teams. What you need isn't to spend 14,500 Euro, but to get a standard application penetration test done at roughly a quarter of that cost.

edit: I wrote something wrong above, sorry about that.

There is something to watch out for. Payment information changes are never verified through the channel they came from.

Hope this helps.

There are three things to check when doing this. Everything goes well for the first three months; problems arise in the fourth.

If you have questions, write them; I'll answer as best I can.

I went through the same thing two years ago. When we decide without measuring, we always end up in the same place.

Correct me if I'm wrong.

I was thinking the same thing. Most incidents start with a leaked password, not a vulnerability.

This is my opinion, I'm not claiming it's absolute truth.

I've been down this road, let me tell you. People defend habits not processes. Resistance comes from there.

Most incidents start with a leaked password, not a vulnerability. Just leaving this note, it might be useful.

Let's separate the concepts, they're getting mixed up. Taking notes for two weeks yields better results than a six-month estimate.

If permission and scope aren't in writing, don't start that test.

Same here.

I'm in the same situation, that's why I'm asking. Don't hesitate to ask; those who don't ask always pay more.

Start with a small trial; don't commit to everything at once. This is my opinion, I'm not claiming it's absolute truth.

This thread is archived.

this thread is archived but taking notes for two weeks yields better resuts than a six-month estimate.

this is my opinion I'm not claiming it's absolute truth.

I'd appreciate it if you shared the outcome.