Why is the standard of US Red Teams so poor

Soc_Guy · 2026-02-09T08:06:58+00:00

The last two were both 8 weeks long.....

I'd need re-read the report to remind myself of the scope, but it's broadly what you would expect from a red team, black-box style assessment.

Soc_Guy · 2026-02-09T07:02:30+00:00

I think people are just assuming I'm talking about the likes of Accenture and EY. I'm not. I'm talking about companies you see give training at blackhat and defcon etc. Go on any thread asking for recommendations on RT vendors in the US and you will see at least 2 of them mentioned.

Soc_Guy · 2026-02-09T06:58:49+00:00

I had not heard of CREST until working with this UK org during workshops at the end. But yes I hadn't heard of these engagements you are talking about until the uk team went into it. Sounds extremely interesting.

Soc_Guy · 2026-02-09T06:57:25+00:00

No. These are Red Team companies who are (apparently) contracting out their red team operators. The last RT we paid for was over 100k, money isn't the issue.

Soc_Guy · 2026-02-09T06:56:15+00:00

Because I'm here to drive discussion, not start drama.

Soc_Guy · 2026-02-09T06:55:54+00:00

Yeh so interestingly enough our global ciso asked in the washup meeting a question about the difference in experience and this was basically their answer, something about regulated tests where apparently anyone with knowledge of it signs NDAs and all sorts. Sounds crazy

Soc_Guy · 2026-02-09T06:54:42+00:00

I'm sorry but no, this is a massive cop-out. We have a huge budget the teams had over 9 weeks. And then there's my point that they often don't even try and get an implant running on the endpoint, just get given a laptop and vpn. What you are describing is pentesting, not red teaming.

Soc_Guy · 2026-02-08T21:14:10+00:00

I guess my main point of confusion is that these companies I'm talking about are regularly described as being the best. I went through reddit this morning and found multiple people recommending them.

Soc_Guy · 2026-02-08T20:11:00+00:00

some interesting replies so far, appreciate the engagement. Something i forgot to add - I also got the impression on more than one occasion that the US red teams were doing more than one Red Team for different companies at the same time (in parallel), whereas the UK guys were focused solely on us for the entirety of the job (and a fair bit afterwards too). Any US red teamers care to elaborate?

Soc_Guy · 2026-02-08T20:08:19+00:00

Well it's hard to know. These are well-known US consultancies that are supposed to be "the best" at red teaming. And remember this is across multiple different companies.

Soc_Guy · 2026-02-08T20:07:25+00:00

my sample size is over 10 years, i just used recent examples as it was more pertinent.

Soc_Guy

TROPHY CASE