Red team assessment in Canada

A red team exercise answers a different question from a penetration test. It is not a bigger pentest, it is not better value, and for most Canadian companies buying one is a way of paying six figures to learn something a $15,000 test would have told you.

Last reviewed 2026-08-31Written by Jacob Masse, TrazTech Inc.

A red team assessment in Canada costs between $50,000 and $150,000 CAD and runs four to twelve weeks. It buys the answer to one question: if a capable attacker went after this company for a month, would anybody notice and would anybody stop them. A penetration test answers a different question, which is what is wrong with this system, and it costs a fifth as much because finding flaws is faster than emulating an adversary.

The difference, stated once and plainly

A penetration test measures the systems. A red team assessment measures the people and the tooling that are supposed to catch someone attacking those systems. Everything else follows from that.

Penetration test

Scoped by asset. Your team knows it is happening. Coverage is the goal, so the tester tells you every weakness found in the agreed scope, and the report is a list you can work through.

Red team assessment

Scoped by objective. Almost nobody internally knows. Stealth is the goal, so the team takes one route to the objective and deliberately leaves other weaknesses untouched. The report is a narrative and a timeline, not a list.

Purple team exercise

Same techniques, run openly and in the room with your defenders, one technique at a time, checking whether each one alerts. Cheaper than a red team, faster, and better at improving detection because the feedback loop is minutes rather than weeks.

Assumed breach test

Starts the tester inside with a standard user account or a foothold on a laptop. It is a penetration test, not a red team, but it answers the question most companies actually have about lateral movement.

You need something for it to measure

Red teaming is over-sold in Canada, on a prerequisite vendors rarely raise. A red team measures detection and response. If nobody is watching alerts outside business hours, the exercise will succeed on day two, the report will say so, and you will have spent $70,000 CAD to learn something your own security lead could have told you for free.

1. Somebody is paid to watch alerts, either your own staff or a managed detection provider under contract with a response time in it.
2. Endpoint detection is deployed across the fleet, not on the servers only.
3. You have an incident response plan that has been used at least once, in a real event or a tabletop.
4. You have already had penetration tests, and the findings from them are closed rather than filed.
5. Someone senior has agreed in advance what happens if the team reaches the objective. That is a bad moment to invent a policy.

Miss the first four and the correct purchase is an internal network test on an assumed breach basis, which costs $12,000 to $35,000 CAD and finds the same lateral movement paths with none of the theatre. Miss only the third and a purple team exercise gets you further per dollar.

Comparing firms for this? Tell us what you need and it goes to the ones in the directory that do this work. No charge, and no phone number required.

What the engagement actually contains

Scenario design comes first, and it is a week or two of work before anything technical happens. A credible engagement starts from threat intelligence about who realistically targets your sector, then writes an objective in business terms: reach the payment approval system, exfiltrate a copy of the customer database, obtain the ability to push code to production. Vague objectives such as "get domain admin" produce vague reports.

Then comes reconnaissance, initial access, and the slow part. Initial access in a Canadian engagement is usually phishing or a password spray against an exposed service, occasionally a physical visit to a reception desk. After that the team moves toward the objective while trying not to trip anything. That is what makes it slow, and therefore expensive. Every step is logged with a timestamp so it can be laid against your own alerting afterwards.

The deliverable is the part that differs most from a penetration test. You should receive a narrative timeline, a list of every action taken with the time it happened, a comparison against what your detection tooling recorded, and a set of detection gaps written as engineering work rather than as findings. If a firm proposes to deliver a red team report in the same template as a penetration test report, they are selling a long penetration test.

Whether it satisfies an auditor

It usually does, and it is usually the wrong way to spend the budget. A SOC 2 or ISO 27001 auditor asking for evidence of technical testing will accept a red team report, but they will then ask for coverage of the systems in your scope statement, and a red team deliberately does not provide that. The standard outcome is that you buy a red team and a penetration test in the same year. What each framework actually asks for is on SOC 2 penetration testing and ISO 27001 penetration testing, and PCI DSS is prescriptive enough that a red team never substitutes for the required tests.

Regulated financial institutions are the exception. Where a supervisor or a large banking customer expects intelligence-led testing against a published scheme, the scheme names the shape of the exercise and you follow it rather than designing your own. That requirement arrives in writing and is not ambiguous.

What moves the price

Those are the same day rates under every quote in this market, and the arithmetic is on penetration testing cost in Canada. A red team is expensive because it is many operator weeks, not because the rate is different.

Rules of engagement, which matter more here

Because almost nobody internally knows the exercise is running, the paperwork does more work than in a normal test. Three things need to exist before anything starts. An authorisation letter, signed by an officer of the company, that an operator can produce if a security guard or a police officer detains them. A named escalation contact who is awake and reachable at any hour and can call the exercise off. And a written rule about what happens if the team finds a real intruder already inside, which happens often enough that it should not be improvised.

Where the exercise touches personal information, the same accountability rules apply as in any test: under PIPEDA, and under Law 25 in Quebec or PIPA in British Columbia and Alberta, the information stays your responsibility after it reaches the testing firm. Say in the contract what may be copied, where it is held and when it is destroyed. PIPEDA compliance covers the transfer rules in more detail.

Common questions