Service offering
Engagements, not packages.
Every engagement is scoped against a system that already exists and an objective you can state. What follows is the range of work Red Cell takes on, what each piece covers, and what you receive at the end.
For what this produces in practice, read an engagement record.
01 / Flagship service
AI red teaming
An assistant, copilot or agent has been given access to real systems and real data, and nobody has tested what it can be made to do with that access.
Read the full ai red teaming pageScope examples
- Chat assistants and copilots embedded in a product
- Retrieval applications reading from internal document stores
- Support and operations agents with tool or API access
- Internal assistants connected to identity, ticketing or code systems
What you receive
- Threat model for the deployed architecture
- Reproducible evaluation cases with evidence
- Control recommendations mapped to the failure they address
- Agreed regression checks to run after remediation
02 / Service
Network penetration testing
You need to know what an attacker reaches from the internet, and how far a foothold inside the network travels before it reaches something that matters.
Scope examples
- Internet-facing hosts, services and remote access
- Internal segments, workstation and server estates
- Active Directory and directory service configuration
- Segmentation and trust boundaries between zones
What you receive
- Ranked findings with reproduction steps and evidence
- Attack paths traced from entry point to affected asset
- Remediation guidance written for the team that owns the system
03 / Service
Web application and API testing
Your product holds customer data behind authentication, and a customer, auditor or investor wants evidence that the authorization model holds.
Scope examples
- Authentication, session handling and account recovery
- Authorization across roles, tenants and object ownership
- Business logic, workflow and state-transition abuse
- REST, GraphQL and service-to-service interfaces
What you receive
- Findings tied to the affected endpoint and user role
- Evidence captured without retaining production customer data
- Fix guidance at the level of the control, not the single request
04 / Service
Cloud security assessments
Infrastructure grew faster than the permission model, and it is no longer obvious which identity can reach which data.
Scope examples
- Identity, role and permission boundaries
- Storage exposure, key management and secret handling
- Network controls, private connectivity and public endpoints
- Workload identity, CI/CD and deployment pipeline trust
What you receive
- Privilege escalation and lateral movement paths in the account
- Exposure findings with the configuration that caused them
- Prioritized remediation sequence for the platform team
05 / Service
Red team and adversary simulation
You have a security programme and want to know whether it detects and responds to a realistic intrusion, not whether a scanner finds a missing patch.
Scope examples
- Objective-based operations against agreed crown-jewel targets
- Adversary behaviours selected with you during threat modelling
- Agreed levels of stealth and detection tolerance
- Defined escalation contacts and stop conditions
What you receive
- Operation timeline matched against what your team observed
- Detection and response gaps with the telemetry that was missing
- Findings for both the security team and the system owners
06 / Service
Purple team exercises
Your detection engineers need to know which behaviours they currently see, and to fix the gaps while the attack is still on the screen in front of them.
Scope examples
- Agreed behaviour set executed with your defenders present
- Live comparison of activity against telemetry and alerts
- Detection tuning and validation inside the session
- Repeatable test cases handed over at the end
What you receive
- Coverage record for each behaviour exercised
- Detection improvements validated during the exercise
- Reusable test cases for ongoing regression
08 / Service
Compliance evidence mapping
A customer security review or an assessor has asked for testing evidence, and you need the report to line up with the requirement being asked about.
Scope examples
- Requirements confirmed with you before testing begins
- Scope and evidence expectations agreed in the statement of work
- Report structure aligned to the evidence you have to produce
- Retest record for findings remediated within the agreed window
What you receive
- Assessment report structured for review by a third party
- Mapping of findings to the requirements agreed in scope
- Retest results for the findings covered by the agreement
09 / Terms
What a web page cannot quote.
Starting prices for each engagement type are published on the pricing page, and each reflects a defined scope. The final fee and duration depend on the system, so they are agreed in writing before work begins, and no turnaround is promised before the scoping conversation.
Testing can support compliance evidence and customer assurance requirements. Scope and evidence mapping depend on the applicable requirements. A single engagement does not automatically satisfy every framework a customer or assessor may raise, and we will say so during scoping rather than in the report.
Retesting is one verification cycle for the agreed findings, within the period defined in the statement of work. The full engagement sequence is here.
Tell us what you need to test.
Pick the closest service or ask for help defining the scope. Either way the first step is the same conversation.
07 / Service
Social engineering and phishing
You want a measured view of how a credential or approval request is handled, agreed in writing beforehand and run without ambushing your staff.
Scope examples
What you receive