How much does it cost?
There is no published price to cite. Wattlecorp’s FAQ says the cost depends on scope, infrastructure size, cloud and on-premises environments, testing duration and scenario complexity, and that a custom quote follows scoping. Paranoid Security’s red teaming page says a consultation covers scope, timeline and pricing. Expect a quote after a scoping call, not before.
What raises the price?
| Driver | Why it matters |
|---|---|
| Number and complexity of scenarios | More techniques to run, observe and tune |
| Environment size | More systems, log sources and rules to check |
| Cloud and on-premises mix | More telemetry paths |
| Duration | More days of specialist time on both sides |
| Retest | A second run to confirm fixes. Wattlecorp publishes one as its fourth phase |
| Delivery model | On-site, remote or hybrid, as Group-IB describes |
| Report depth | Itemised findings, walkthroughs, executive briefs |
How long does it take?
Only a few providers publish a length.
- Mandiant: about three weeks, two for testing and one to assemble and deliver the report, per its datasheet. See the Mandiant profile.
- Group-IB: one to eight weeks, depending on scenarios and complexity. See the Group-IB profile.
- Most others publish no duration.
Can it be scoped small?
Yes. Pick the few scenarios that matter most to your regime or your last incident, run them against one environment and agree what the retest covers. Then widen. A wide first scope with no retest tends to leave a long gap list and no evidence that fixes work.
What should the quote contain?
Scenarios and techniques covered, the environment in scope, named roles on both sides, report contents, retest terms and the entity that contracts. If these are missing, you cannot compare quotes. The selection checklist has the matching questions.
For how the work runs, see the assessment step by step.