Services

Two services. One copy of your systems to attack.

Red Team Setup builds a sandboxed copy of your production systems and attacks it with a swarm of AI agents. Standing Red Team keeps attacking it as your systems and the attackers’ models change.

Request a free scoping call

Red Team Setup Standing Red Team

One-time · Fixed quote after the scoping call

Red Team Setup

We copy your production systems into a sandbox, attack the copy with our agent swarm and give you a verified findings report, with one re-test included.

What happens

  1. Scoping call. Free. We learn what you run and agree what’s in scope. Afterwards you get a fixed quote.
  2. Survey. A forward-deployed engineer surveys your company, your teams and your infrastructure.
  3. Action plan. The engineer writes a plan for building your mock environment, including the most pain-free way for your team to stand it up, and where it will run.
  4. Build. The mock environment is built: a sandboxed copy of your production systems, as realistic as possible, with synthetic data.
  5. Attack. Our AI agents attack it autonomously, at full aggression.
  6. Verify and report. An engineer reproduces every finding before it goes in your report.
  7. Re-test. After you fix the findings, we run the red team once more to confirm the fixes hold.

Who it’s for

MedTech companies that want to know how their backends, APIs, cloud and web apps stand up to AI-driven attacks, without putting production at risk. Every Standing Red Team starts here.

What you get

  • A findings report: prioritised vulnerabilities with attack paths, reproduction steps and fix guidance
  • No false positives: every finding verified by an engineer
  • One re-test to confirm your fixes hold
  • A mock environment we keep set up and operate for later runs

What we need from your team

  • Time with the people who know your systems, for the survey
  • A choice of where the environment runs: your cloud or ours
  • Help standing the environment up, following the action plan
  • Fixes for the findings, before the re-test
Ongoing · Monthly fee · After Red Team Setup

Standing Red Team

We keep your mock environment matching production and attack it again every month, and whenever a significant new open-source model is released.

What happens

  1. We keep the copy current. As production changes, we update the mock environment to match.
  2. Monthly run. The agent red team attacks the environment once a month.
  3. New-model runs. When a significant new open-source model is released, we run the red team again, so you know where you stand against it.
  4. Updated report. Every run produces an updated findings report, with every finding verified by an engineer.

Who it’s for

Teams that have completed Red Team Setup and want to keep up as their own systems change and as attackers get better models.

What you get

  • An updated, verified findings report after every run
  • A mock environment kept in step with production
  • A red team run against each significant new open model

What we need from your team

  • A completed Red Team Setup: we reuse its environment
  • A way for us to keep up with changes to production, agreed with you

What we attack

In scope

  • Backend services and APIs
  • Cloud infrastructure and data stores
  • Web apps and portals, attacked through a real browser driven by our agents

Not in scope

  • The devices themselves: on-device software and physical or wireless interfaces
  • Mobile apps
  • Supply chain
  • Social engineering

Why a real browser? Some attacks only exist inside a browser: cross-site scripting, cross-site request forgery and broken login or session flows. Scanning the backend alone would miss them.

How it runs

Where the environment runs

In an isolated account in your own cloud, or hosted by us. You choose, and we settle it during the survey.

Your data

Synthetic data by default. We don’t need real patient data. If you want de-identified data for extra realism, we agree that case by case.

How findings are verified

The agents attack on their own. An engineer then reproduces and verifies every finding before it goes in the report, so the report has no false positives.

What you keep

Every findings report. The mock environment stays set up for re-tests and later runs, and we operate it.

How the two fit together

  1. Red Team Setup comes first. It builds your mock environment and gives you your first verified report and one re-test. You pay a fixed quote, agreed after the scoping call.
  2. Standing Red Team follows. It reuses the same environment, keeps it matching production and attacks it every month and after each significant new open model. You pay a monthly fee.

No red team run finds everything. What we can tell you is what our agents found, and that each finding is real.

Start with a free scoping call

Tell us what you run. We’ll tell you what it would take to copy it and attack it, and give you a fixed quote.

Request a free scoping call