Red teaming has moved from a military planning habit to a written legal duty. Since 8 July 2025, EU financial entities that their supervisor identifies must run an intelligence-led red team exercise at least every three years under the Digital Operational Resilience Act, with the active attack phase lasting at least 12 weeks (Regulation (EU) 2022/2554, Article 26; Delegated Regulation (EU) 2025/1190, Article 11). The Bank of England has run the same kind of test through CBEST since 2014, and Canada's financial regulator, OSFI, published its own intelligence-led framework in April 2023. Outside regulated finance, the case is simpler: adversaries now dwell inside a network for a median of 14 days before anyone notices, up from 11 (Mandiant M-Trends 2026), and a red team is the one assessment built to measure that blind spot.
Quick answer: Red teaming is an authorized, objective-based simulation of a real attacker that tests whether your people, processes and technology detect and stop an attack, while your defenders are not told it is happening. A penetration test asks what is exploitable; a red team asks whether anyone would notice. Buy a red team when you have a security operations capability worth testing, and start with a penetration test or an assumed breach engagement if you do not.
This guide gives the definition, the differences from penetration testing and purple teaming, how an engagement runs, which regulators require it in the US, Canada, the UK and the EU, how long it takes, what it costs, and what the report should contain. Regulatory details were checked against the official texts on 25 October 2026, and every figure links to its source.
Key facts
Definition (US government glossary): a red team is a group authorized to "emulate a potential adversary's attack or exploitation capabilities" against an enterprise (NIST CSRC glossary, from CNSSI 4009-2022).
EU law: identified financial entities must run threat-led penetration testing (TLPT) "at least every 3 years" on live production systems (DORA, Article 26).
Minimum attack window: DORA's TLPT standard sets the active red team testing phase at "at least 12 weeks" (Delegated Regulation (EU) 2025/1190, Article 11).
UK: the Bank of England reports an average CBEST project of around 9 to 12 months (Bank of England, CBEST Implementation Guide).
Canada: OSFI's I-CRT framework covers Systemically Important Banks and Internationally Active Insurance Groups on a three-year cycle, and Guideline B-13 expects every federally regulated financial institution to run penetration testing and red teaming (OSFI I-CRT; OSFI B-13).
Readiness signal (Stingrai data): 92% of findings from Stingrai's internal network penetration tests were High or Critical, and 56.9% were outdated or unpatched software (State of Penetration Testing 2026). An estate in that state needs patching before it needs a red team.
What is red teaming?
Red teaming is an authorized exercise in which a small team of specialists emulates a specific, realistic adversary against an organization, pursuing an agreed objective while staying covert, to measure whether defenders detect, contain and respond to the attack.
That definition has three working parts, and each one separates a red team from other security testing:
It is objective-based. A red team is given a goal, such as reaching the payments system, reading the chief financial officer's mailbox or obtaining domain administrator rights, rather than a list of assets to examine. Anything that realistically leads to the goal is in play unless the rules of engagement exclude it.
It emulates a named kind of adversary. The scenario is built from threat intelligence about who would attack this organization and how: a ransomware affiliate, a state-backed espionage group, a financially motivated insider. The tactics come from that adversary's known behavior, usually mapped to MITRE ATT&CK.
It is covert. Only a small control group, often called the white team, knows the exercise is running. The security operations center (SOC) and incident responders react as they would to a real intrusion, which is what makes the measurement honest.
The term comes from military wargaming, where an opposing force played the enemy so that commanders could test their plans against a thinking adversary rather than a script. The US government's glossary keeps that sense: a red team is a group authorized "to emulate a potential adversary's attack or exploitation capabilities," with the stated purpose of improving security by showing both the impact of a successful attack and what works for the defenders, the blue team (NIST CSRC, from CNSSI 4009-2022).
In cyber security the colors have settled into a simple vocabulary. The red team attacks. The blue team defends: the SOC, incident response and the people who run detection. The white team controls the exercise, holds the stop authority and keeps it safe. A purple team is not a separate group but a way of working, in which red and blue sit together, run techniques one at a time and tune detection as they go.
Red teaming vs penetration testing vs purple teaming
The three are often bought interchangeably and they answer different questions. A penetration test measures your attack surface, a red team measures your defenders, and a purple team trains them.
Penetration test | Red team | Purple team | |
|---|---|---|---|
Question it answers | What is exploitable in this defined scope? | Would anyone notice a real adversary reaching what matters most? | Which attacker techniques does our detection see, and can we fix the gaps now? |
Scope | An asset list: applications, IP ranges, cloud accounts | An objective, with whatever surface leads to it | A list of techniques, usually ATT&CK-mapped |
Are defenders told? | Usually yes | No; only a small control group knows | Yes; both teams work together |
Stealth | Not a goal | Required | Deliberately abandoned |
Typical duration | Days to two weeks | Weeks for commercial work, months when regulated | Days to two weeks |
Main deliverable | Findings with evidence and remediation | Attack narrative with detection and response timings per stage | Per-technique detection results and tuned detection content |
Buy it when | You need coverage, remediation and audit evidence | You need to know whether your defenses hold | Your SOC needs to improve quickly and measurably |
Two consequences matter at purchase. First, a red team is not a bigger penetration test: it will not give you a complete list of vulnerabilities, because it stops looking once it has a quiet path to the objective. Second, a penetration test does not satisfy a red teaming requirement. DORA, CBEST and OSFI's framework all describe an intelligence-led exercise against live systems with defenders unaware, which a scoped penetration test is not. The longer comparison, including continuous validation, is in red team vs penetration test vs continuous validation, and the case for running a purple team first is in purple teaming.
What a red team engagement tests
A red team tests the whole defensive system, not one layer of it. In practice that means four surfaces, and a proposal that is silent on one of them has excluded it:
People. Phishing, voice phishing (vishing), help desk pretexting and other social engineering that hands an attacker credentials or a foothold. Help desk password and multi-factor resets are a common target, as covered in the Scattered Spider account recovery red team.
Process. Whether alerts are triaged, escalated and acted on in time; whether the incident response plan works under pressure; whether the help desk follows its own verification steps.
Technology. Endpoint detection, logging coverage, identity controls, Active Directory and cloud identity configuration, network segmentation, and the detection rules your SOC relies on.
Physical. Badge cloning, tailgating and on-site entry, where in scope and priced. Physical work is normally an explicit add-on with its own legal authorization.
The output is evidence about your defenders: what they prevented, what was logged but never alerted, what alerted but was not acted on, and how long each step took.
How a red team engagement runs
Commercial engagements and regulator-led tests follow the same skeleton. Regulated frameworks add formal phases, an independent threat intelligence provider and supervisor oversight around it.
Planning and rules of engagement. The objective, the scenario, the control group, stop conditions, the authorization letter and the out-of-bounds list (destructive actions, real data exfiltration, safety systems, third parties you do not control) are agreed in writing. The clauses that matter are in our red team rules of engagement checklist.
Threat intelligence. The team profiles the adversaries that realistically target your sector and region and turns their behavior into scenarios. Our guide to which threat group a red team should emulate by industry covers this choice, and red team objectives and crown jewels covers setting the goal.
Initial access. The team earns a foothold the way the emulated adversary would: through an exposed service, a phishing or vishing campaign, stolen credentials or, where in scope, a door. In an assumed breach engagement this phase is skipped and the team starts from a provided workstation or account.
Lateral movement and privilege escalation. From the foothold, the team quietly maps the environment, harvests credentials, abuses identity misconfigurations and moves toward the objective, trying to stay below the detection threshold.
Actions on objectives. The team proves it reached the goal with agreed evidence, a flag, without causing the real harm a criminal would.
Reporting, replay and retest. The team writes the attack narrative, reconstructs a timeline of what the defenders saw, replays the path with the blue team so detection content can be written, and retests once fixes land.
The control group can pause or stop the exercise at any point. Under DORA's standard, the control team lead may suspend the test where there is a risk of real disruption and, as a last resort, continue it as a limited purple teaming exercise (Delegated Regulation (EU) 2025/1190, Article 11).
Red team tools and techniques
Red teams describe what they do in the language of MITRE ATT&CK, the public knowledge base of adversary behavior. Its Enterprise matrix currently lists 15 tactics, from Reconnaissance and Initial Access through Credential Access, Lateral Movement and Command and Control to Impact (checked 25 October 2026). Mapping every action to an ATT&CK technique is what lets your detection engineers turn a red team report into rules they can test.
From a defender's point of view, the tooling falls into four groups:
Command and control (C2) frameworks, which give operators a covert channel back into compromised machines. Defenders look for them through beaconing patterns, unusual parent and child processes and egress to unfamiliar infrastructure.
Identity and Active Directory tooling, which enumerates and abuses Kerberos, delegation, certificate services and access control lists. This is where most internal paths to domain administrator run. Stingrai's own open-source tool, StingAD, packages that workflow in a single binary, and the StingAD walkthrough shows a lab domain falling from one low-privileged account to domain administrator.
Cloud and identity provider tooling, for moving from a compromised workload or user into the cloud control plane through over-permissive roles, service principals and consent grants.
Living off the land, using administration tools already present on the target, which is often the hardest behavior for a SOC to separate from normal work.
How good a red team is depends less on its tools than on its judgment: which path to try, when to wait, and when a noisy action will burn the whole operation. Coverage counts are a weak quality signal; grading MITRE ATT&CK coverage in a red team proposal explains why "we cover 180 techniques" is not a score.
Who needs a red team, and who should start with a penetration test
A red team pays off when there is a defensive capability to measure. It is a poor first purchase for an organization that has never fixed the findings a penetration test would hand it.
Stingrai's own data shows why the order matters. Across the internal network penetration tests in Stingrai's State of Penetration Testing 2026 report (8 tests and 408 verified findings, October 2024 to August 2026), 92% of findings were High or Critical and 56.9% were outdated or unpatched software. A red team dropped into an estate like that will reach its objective quickly through known vulnerabilities, and the report will mostly tell you to patch, which a cheaper internal penetration test would have told you along with a complete list.
Your situation | Start with | Why |
|---|---|---|
No 24/7 monitoring, or detection has never been measured | Internal network penetration test and a purple team | Find and fix the known paths first; build detection you can then test |
Monitoring in place, perimeter tested, unsure how far an intruder would get | Spends the budget on the inside, where prevention is weakest | |
Mature SOC, regular penetration tests, board or customers asking whether defenses hold | Full-scope red team | Tests people, process and technology end to end against a realistic adversary |
Designated by a financial supervisor | The regulator's framework (DORA TLPT, CBEST, I-CRT) | The shape, providers and cadence are prescribed |
Building AI agents or LLM features | A different discipline aimed at model and agent behavior |
Red teaming frameworks and regulations
Regulators do not use the words consistently, so the table below sorts the rules by what they actually require. Only the first four prescribe an intelligence-led red team; the last two are baseline testing rules that red teaming can help satisfy.
Figure 1: Regulator red teaming frameworks and baseline testing rules, checked against the official texts on 25 October 2026. Sources: Regulation (EU) 2022/2554; Delegated Regulation (EU) 2025/1190; ECB; Bank of England; OSFI; 23 NYCRR 500.5.
Framework | Jurisdiction | Who is in scope | Cadence and shape |
|---|---|---|---|
DORA TLPT | European Union | Financial entities identified by their competent authority; microenterprises excluded | At least every 3 years, on live production systems supporting critical or important functions; active red team phase of at least 12 weeks |
TIBER-EU | Adopting EU member states | Entities chosen under each national implementation | The ECB's framework, published May 2018 and updated in 2024 to align with DORA's TLPT standard |
CBEST | United Kingdom | Systemically important firms and financial market infrastructures selected by the Bank of England, PRA and FCA | Regulator-led; average project around 9 to 12 months |
OSFI I-CRT | Canada | Systemically Important Banks and Internationally Active Insurance Groups; other institutions on request | Three-year supervisory cycle plus event-driven tests |
OSFI Guideline B-13 | Canada | All federally regulated financial institutions | Regular penetration testing and red teaming using an intelligence-led approach |
NYDFS Part 500 | New York, United States | Covered financial services entities | Penetration testing from inside and outside the network boundary at least annually; no red team mandate |
DORA TLPT and TIBER-EU
Article 26 of DORA requires identified financial entities to carry out threat-led penetration testing "at least every 3 years," covering several or all critical or important functions on live production systems, and lets the competent authority raise or lower that frequency (Regulation (EU) 2022/2554). Article 27 sets the bar for testers: proven expertise in threat intelligence, penetration testing and red team testing, certification by an accreditation body or adherence to a formal code of conduct, and professional indemnity insurance. Firms that use internal testers must contract external testers every three tests, significant credit institutions must use external testers only, and the threat intelligence provider must always be external when internal testers are used.
The detailed rules sit in Delegated Regulation (EU) 2025/1190, published in the Official Journal on 18 June 2025 and in force since 8 July 2025. Its Article 11 fixes the active red team testing phase at a minimum of 12 weeks. The European Central Bank's TIBER-EU framework, developed with the EU's national central banks and published in May 2018, was updated in 2024 to align fully with that standard, so many national authorities deliver the DORA test through their TIBER program. The head-to-head comparison is in TIBER-EU vs CBEST vs DORA TLPT, and readiness steps are in the DORA TLPT playbook.
CBEST in the UK
CBEST has been part of the supervisory toolkit of the Bank of England, the Prudential Regulation Authority and the Financial Conduct Authority since 2014, used to assess the cyber resilience of systemically important firms and financial market infrastructures. The Bank's implementation guide gives an average project duration of around 9 to 12 months, with indicative phases of about 6 weeks for initiation, 10 weeks for threat intelligence, 14 weeks for penetration testing and 4 weeks for closure, and it requires an independent threat intelligence provider and an independent penetration test provider, each CBEST accredited (Bank of England, CBEST Implementation Guide).
OSFI I-CRT and B-13 in Canada
OSFI published its Intelligence-led Cyber Resilience Testing (I-CRT) framework on 1 April 2023. Its current scope is all Systemically Important Banks and Internationally Active Insurance Groups, on a three-year cycle plus event-driven assessments, and OSFI evaluates requests from other institutions case by case. Canada has six domestic systemically important banks: Bank of Montreal, Bank of Nova Scotia, Canadian Imperial Bank of Commerce, National Bank of Canada, Royal Bank of Canada and Toronto-Dominion Bank (OSFI). The framework separates the threat intelligence provider from the red team provider and recommends contracting different vendors for each.
Every other federally regulated financial institution still has a testing expectation. Guideline B-13 says institutions "should also regularly perform tests and exercises" to find gaps in their cyber security programs, naming penetration testing and red teaming and asking for an intelligence-led approach. What proportionate testing looks like below the I-CRT tier is set out in OSFI B-13 and I-CRT.
The United States
No US regulator mandates a red team exercise for private companies in the way DORA does. The closest common rule is New York's cybersecurity regulation, which requires covered entities to conduct penetration testing "from both inside and outside the information systems' boundaries" by a qualified party at least annually (23 NYCRR 500.5). A red team can contribute evidence to that program, but the annual penetration test is the stated requirement; our NYDFS penetration testing requirements guide covers it in full.
How long does red teaming take?
A commercial red team runs for weeks; a regulator-led one runs for months, mostly because of formal preparation, a dedicated threat intelligence phase and closure.
Figure 2: Indicative phase durations in weeks for OSFI I-CRT and Bank of England CBEST, with DORA's 12-week minimum for active red team testing. Both regulators say their indicative timings are not fixed durations. Sources: OSFI I-CRT framework; Bank of England CBEST Implementation Guide; Delegated Regulation (EU) 2025/1190, Article 11.
Engagement shape | Typical elapsed time | Source |
|---|---|---|
Single-scenario assumed breach | 2 to 3 weeks | Stingrai planning guidance |
Full-scope red team from outside, including social engineering | 4 to 8 weeks | Stingrai planning guidance |
OSFI I-CRT, all four phases | About 24 to 36 weeks, by summing OSFI's indicative phases | |
CBEST | Average around 9 to 12 months | |
DORA TLPT active red team phase | At least 12 weeks |
Elapsed time always runs longer than testing time. Legal authorization, threat intelligence, the SOC replay session and the retest all take real calendar weeks, and the retest is bounded by how fast your own engineers fix things.
How much does red teaming cost?
Red teams are priced on senior tester-days, not per asset, so the cost follows the scenario: how many objectives, how much reconnaissance, whether social engineering or physical entry is included, and how long the operators must stay covert. Stingrai quotes red team engagements to scope rather than from a price list.
For a public reference point, one UK provider, EJN Labs, publishes red team prices of £15,000 to £35,000 for a focused two to three week exercise and £75,000 or more for threat-intelligence-led red teaming aligned to STAR and TIBER-UK (EJN Labs, UK Penetration Testing Cost Guide, checked 25 October 2026). At the European Central Bank's reference rates for 23 October 2026 (US$1.3368 and C$1.8709 per pound), that is about US$20,100 to US$46,800 (C$28,100 to C$65,500) for a focused exercise and about US$100,300 (C$140,300) or more for an intelligence-led one. Treat these as one firm's published prices, not a market survey. The six factors that move a quote are broken down in how much a red team engagement costs in 2026, and regulated pricing is covered in DORA TLPT cost.
Three decisions control most of the total. Set one tight objective instead of asking for everything. Start from an assumed breach position if initial access has already been proven, rather than paying again to prove it. And compare proposals by tester-days and objectives, not day rates.
What a red team report contains
The report is the product, and it should read nothing like a penetration test report. Ask for these items in the contract:
Deliverable | What good looks like |
|---|---|
Executive summary | The objective, whether it was reached, what the defenders saw, and what to fix first, in two or three pages |
Attack narrative | A dated, step-by-step account of the operation, including decisions and dead ends |
Detection and response timeline | For each stage: prevented, logged without alert, alerted, acted on, and how long each took |
Objective and flag outcomes | Which objectives were reached, against criteria agreed before the test |
ATT&CK mapping | Every action mapped to a technique ID so detection engineers can write and test rules |
Root-cause findings | The control, configuration or process failures behind each path, with remediation |
Replay and retest | A session that replays the path with your SOC, and a retest once fixes are in |
If a proposal does not commit to per-stage detection timings and a replay session, it is selling an attack, not an assessment. Benchmarks for reading your own results are in red team detection benchmarks for 2026.
AI red teaming, briefly
"AI red teaming" uses the same word for a different job: adversarially testing an AI model, an LLM-powered application or an AI agent for prompt injection, jailbreaks, data leakage and unsafe tool use. It borrows the red team mindset but not the covert, organization-wide operation. If you are shipping LLM features or agents, read AI red teaming for LLM and agentic applications and see Stingrai's AI and LLM penetration testing service.
How Stingrai runs red team engagements
Stingrai is a global CREST-accredited penetration testing services company founded in Toronto, Canada in 2021, trusted by companies from startups to enterprises to meet audit requirements for SOC 2, ISO 27001, CMMC, PCI DSS and HIPAA. OSCE³, OSWE, OSEP, CREST CRT certified penetration testers, who are also world-class security researchers and bug bounty hunters. Choose from fully human-led or hybrid (AI agents plus human penetration testers) engagements across web, API, mobile, AI and LLM, cloud, network, Active Directory and social engineering penetration tests and red team engagements.
Red team engagements at Stingrai are human-led from start to finish. Each runs with two named penetration testers from a team holding OSCE³, OSEP, CRTL, CRTO, CRTE and CREST CRT certifications, reviewed by a team lead with 16 years in penetration testing, red teaming and exploit development and by an engagement partner. Scenarios are assumed breach, black-box full chain, or threat intelligence-led in the DORA and TIBER-EU shape, built with threat intelligence partners, across on-premise and cloud estates. Social engineering (phishing, vishing and physical entry), Active Directory attack paths and cloud identity work are done in-house, and the team maintains its own open-source tooling, including StingAD. Findings are posted to Stingrai's PTaaS portal with a working proof of concept as they are confirmed, and the engagement closes with an attack narrative, per-stage detection timings, a replay with your SOC, retesting and an attestation letter. Engagements run as a one-time annual exercise or as a continuous program, from the Toronto head office and the London, UK office.
For a regulator-mandated test, confirm early which provider registers or accreditations your supervisor requires, and check them on the accrediting body's own register before you shortlist anyone.
Next step: Red teaming service | Get a quote | Book a scoping call
Frequently Asked Questions
What is red teaming in cyber security?
Red teaming in cyber security is an authorized exercise in which a small team of specialists emulates a realistic adversary against an organization, pursuing an agreed objective while staying covert, to measure whether the defenders detect, contain and respond to the attack. Unlike a penetration test, it is scoped by an objective rather than an asset list, and only a small control group knows it is running. The US government glossary defines a red team as a group authorized to emulate a potential adversary's attack or exploitation capabilities against an enterprise.
What is the difference between red teaming and penetration testing?
A penetration test asks what is exploitable inside a defined scope, the defenders usually know about it, and it delivers a list of findings with evidence and remediation. A red team asks whether anyone would notice a real adversary reaching what matters most; it is scoped by an objective, kept covert, and delivers an attack narrative with detection and response timings for each stage. A penetration test measures your attack surface, and a red team measures your defenders.
How long does a red team exercise take?
A commercial red team usually runs 2 to 3 weeks for a single-scenario assumed breach and 4 to 8 weeks for a full-scope engagement that starts from outside. Regulator-led tests take months: OSFI's indicative I-CRT phases add up to about 24 to 36 weeks, the Bank of England reports an average CBEST project of around 9 to 12 months, and DORA requires the active red team testing phase alone to last at least 12 weeks.
How much does red teaming cost?
Red teams are priced on senior tester-days, so the cost follows the scenario, the number of objectives and the add-ons such as social engineering or physical entry. As one public reference point, UK provider EJN Labs publishes £15,000 to £35,000 for a focused two to three week red team exercise and £75,000 or more for threat-intelligence-led red teaming, about US$20,100 to US$46,800 and US$100,300 or more at the ECB's 23 October 2026 reference rates. Stingrai quotes red team engagements to scope.
Which regulations require red teaming?
In the EU, DORA requires financial entities identified by their competent authority to run threat-led penetration testing, an intelligence-led red team, at least every 3 years, with an active testing phase of at least 12 weeks. In the UK, the Bank of England, PRA and FCA select systemically important firms for CBEST. In Canada, OSFI's I-CRT framework covers Systemically Important Banks and Internationally Active Insurance Groups on a three-year cycle, and Guideline B-13 expects all federally regulated financial institutions to run penetration testing and red teaming. In the US, New York's Part 500 requires annual penetration testing but no red team.
Do you need a red team if you already run penetration tests?
You need one when your question changes from "what is exploitable" to "would we notice an attacker", which usually means you have monitoring and incident response worth testing. If penetration tests still return many High and Critical findings, fix those first: in Stingrai's State of Penetration Testing 2026 data, 92% of internal network findings were High or Critical. An assumed breach engagement or a purple team exercise is often the better next step before a full-scope red team.
Related reading
Red Team vs Penetration Test vs Continuous Validation and Assumed Breach Engagements Explained
How Much Does a Red Team Engagement Cost in 2026 and Red Team Rules of Engagement
TIBER-EU vs CBEST vs DORA TLPT and OSFI B-13 and I-CRT in Canada
Best Red Teaming and Adversary Simulation Companies 2026 and Continuous Red Teaming vs the Annual Pentest
StingAD: From One Low-Priv Account to Domain Admin and The State of Penetration Testing 2026
Stingrai services: Red Teaming, Adversary Simulation, AI and LLM Penetration Testing
References
European Parliament and Council. _Regulation (EU) 2022/2554, Digital Operational Resilience Act, Articles 26 and 27._ 14 December 2022. https://eur-lex.europa.eu/eli/reg/2022/2554/oj. TLPT cadence, scope on live production systems, identification of entities, and tester requirements.
European Commission. _Delegated Regulation (EU) 2025/1190, regulatory technical standards on threat-led penetration testing._ Official Journal 18 June 2025. https://eur-lex.europa.eu/eli/reg_del/2025/1190/oj. Article 11 sets the minimum 12-week active red team testing phase and the limited purple teaming fallback.
European Central Bank. _TIBER-EU framework._ Published May 2018, updated 2024. https://www.ecb.europa.eu/paym/cyber-resilience/tiber-eu/html/index.en.html. Threat intelligence-based ethical red teaming and its alignment with DORA.
Bank of England. _CBEST Threat Intelligence-Led Assessments: Implementation Guide._ 2024. https://www.bankofengland.co.uk/financial-stability/operational-resilience-of-the-financial-sector/cbest-threat-intelligence-led-assessments-implementation-guide. Scope, roles, indicative phase timings and the 9 to 12 month average project duration.
Office of the Superintendent of Financial Institutions (OSFI). _Intelligence-led Cyber Resilience Testing (I-CRT) Framework._ 1 April 2023. https://www.osfi-bsif.gc.ca/en/guidance/guidance-library/osfis-intelligence-led-cyber-resilience-testing-crt-framework. Scope, three-year cycle, four phases with indicative durations, and separate threat intelligence and red team providers.
OSFI. _Guideline B-13, Technology and Cyber Risk Management._ 31 July 2022. https://www.osfi-bsif.gc.ca/en/guidance/guidance-library/technology-cyber-risk-management. Expectation that all federally regulated financial institutions run penetration testing and red teaming.
OSFI. _Systemically important banks._ https://www.osfi-bsif.gc.ca/en/supervision/financial-institutions/banks/systemically-important-banks. Canada's six domestic systemically important banks.
New York State Department of Financial Services. _23 NYCRR 500.5, Vulnerability management_ (via Cornell Legal Information Institute). https://www.law.cornell.edu/regulations/new-york/23-NYCRR-500.5. Annual penetration testing from inside and outside the information systems' boundaries.
NIST Computer Security Resource Center. _Glossary: red team (from CNSSI 4009-2022)._ https://csrc.nist.gov/glossary/term/red_team. The US government definition of a red team.
MITRE. _ATT&CK Enterprise tactics._ https://attack.mitre.org/tactics/enterprise/. The adversary behavior taxonomy used to map red team actions.
Mandiant (Google Cloud). _M-Trends 2026._ 2026. https://cloud.google.com/blog/topics/threat-intelligence/m-trends-2026. Global median dwell time of 14 days, up from 11.
Stingrai. _The State of Penetration Testing 2026._ 2026. https://www.stingrai.io/blog/state-of-penetration-testing-2026. 55 penetration tests and 1,206 verified findings, segmented by test type.
EJN Labs. _UK Penetration Testing Cost Guide._ Checked 25 October 2026. https://ejnlabs.com/penetration-testing-cost-uk/. One UK provider's published red team prices.
European Central Bank. _Euro foreign exchange reference rates, 23 October 2026._ https://www.ecb.europa.eu/stats/policy_and_exchange_rates/euro_reference_exchange_rates/html/index.en.html. Rates used to convert pounds to US and Canadian dollars.
