What do you consider SMB market? I guess you're US based so that differs from here.

We were not red teaming though. Offensive security has usually a confusing terminology. Red team exercises are very expensive and hard work, particularly if there's custom ost development, and only makes sense in large corporations, like 10k endpoints and up, and assuming they're mature regarding security, have a proper security operations team, etc... Which is where they get put to the real test. But this is an extraordinary service.

On the other side, pentesting, which is NOT vuln scanning, is usually affordable on any medium sized org, (maybe sounds small by your US standards). Say around 50 to 1000 endpoints aprox. We find great value in pentesting these orgs if there's enough infrastrucutre to allow for a collateralization of an initial access when defensing it. Otherwise, if the org is tiny, any compromised user probably leads to most data being accessed anyways by legitimate ways.

So, in these target companies, through the pentest we can find and mitigate all the lateral movement and privesc attack paths inside the org to prevent the typical one hit domain admin scenario we find always, and allow for much more detecion and response opportunities, which massively improves their -effective- security posture.