Agency is suggesting 'Red Teaming': What does this actually mean for a 20-person company?

Pitching Red Teaming to a 20-person company is purely the agency padding their invoice. You don't have an internal cyber defense team (Blue Team) monitoring attacks and watching alerts, so what exactly is the Red Team testing? They'll attack you, turn around and say 'look, we got in', and hand you a 24,000 EUR bill. Steer clear.

Red Teaming covers social engineering, bypassing physical security, and establishing stealthy persistence inside your network. It usually takes weeks. Unless you have strict enterprise audit requirements like ISO 27001 or TISAX, a targeted pentest focusing purely on your cloud infrastructure and API endpoints is more than enough for an SME.

Go with the 6,500 EUR pentest, but define the scope clearly: 'Make sure it includes cloud server configuration, web UI, and API authorization checks.' Just tell the agency, 'We don't have a SOC in place yet, so we're not ready for a Red Team simulation,' and they'll drop it.

We're a 35-person financial consultancy. We agreed to a similar proposal two years ago. The result: They got an employee to click a fake package tracking link, walked into our office looking like an intern, and grabbed a USB drive off an empty desk. We paid 20,000 EUR and the only thing we learned was that staff need to be more careful. We could have achieved that same awareness with a 2,000 EUR internal training session.

Are your clients major enterprise logistics players? Sometimes big enterprise clients put a mandatory 'annual Red Teaming or advanced threat simulation' clause into vendor contracts. If there's no such contractual requirement doing this for a 20-person team is pure overkill.

Correction: I misremembered the figure, it was a bit lower.

a pentest checks if your doors and windows are locked, red teaming tries to climb the roof and break in through the chimney. makes no sense trying to put an alarm on the chimney when you don't even have locks on the front door yet. just get the standard test and move on.

An agency did a Red Team assessment at a 25-person dev shop I used to work at. Some kid walked in disguised as a pizza delivery guy, copied the Wi-Fi password off the whiteboard in the kitchen, and walked out. They wrote a very fancy report, but at the end of the day, all our clients actually cared about was whether our server security patches were up to date. Don't confuse your priorities.

We need to make a distinction here. Just because everyone does it doesn't mean it's right.

Solutions that work at a small scale collapse when you grow; I learned this late. If I were you, I'd go this route.

I went through the same thing two years ago. When making decisions, write down the worst-case scenario too, not just the best.

Thanks, that was the answer I was looking for.

Thanks, that was the answer I was looking for. If the notification path is long, notifications don't arrive; missing notifications mean delayed incident detection.

That's all, sorry if I went on too long.

I agree and I'd like to emphasize that. Just because everyone does it doesn't mean it's right.

If you post the result here, it will help others too.

exactly and not many people know this. everyone rushing into red teaming meaning gets stuck at the same point.

taking notes for two weeks yields better results than a six-month estimate and btw correct me if I'm wrong.

I have a question. Just because everyone does it doesn't mean it's right.

The real issue isn't the number, but what it's based on.

There's a common mistake people make when doing this. Most incidents start with a leaked password, not a vulnerability.

Good luck with that.

i have a question. having backups accessible on the same netwoork and with the same identity makes them part of the target.

Ill try it.

I agree, and I'd like to emphasize that. An automated scan report is not the same as a penetration test.

If you scold false alarms nobody will report again.