Senior-led manual testing with a defined scope, a report your auditor will accept, and a free retest. Built for teams facing SOC 2, ISO 27001, a customer security review, or a cyber-insurance renewal.
Every engagement below is hands-on manual testing performed by a senior operator—never a rebranded vulnerability scan. If your environment is bigger than the stated scope, we tell you the price difference before you commit, in writing.
See what attackers already know about you—without us touching a single system.
Fully credited toward any pentest booked within 90 days—effectively free.
Your internet-facing perimeter, attacked the way a real intruder would.
Assume one workstation is compromised. Find out how far an attacker gets.
The test your SOC 2 auditor and enterprise customers are asking for.
iOS, Android, and the backend API your app depends on—tested together.
You shipped an AI feature. Now find out what it can be talked into.
Everything above tests a system. This tests your organisation. A red team engagement is a goal-driven simulation of a capable adversary—we pick an objective that would genuinely hurt you, then reach it however a real attacker would: through your people, your building, your network, and your defences, with no advance warning to the teams meant to stop us.
We show up. Badge cloning, tailgating, lock and sensor bypass, unattended workstations, and dropping a covert implant on your internal network from a meeting room nobody was watching.
From that foothold: Active Directory attack paths, credential theft, Kerberos abuse, lateral movement across trust boundaries, and escalation to domain dominance or your defined crown jewels.
Off-the-shelf frameworks get caught by signature. Under your signed authorisation and scoped to your estate alone, we write the implants, loaders, and command-and-control infrastructure for your engagement specifically, developed and tested against the EDR stack you actually run, then decommissioned on completion.
Targeted phishing built from OSINT on your real staff, voice pretexting against your help desk and its reset procedures, and physical pretexts to talk a way past reception.
The real deliverable for mature teams: which of our actions your SOC saw, which it missed, how long each took to detect, and where the alert died—mapped to MITRE ATT&CK technique IDs.
Signed rules of engagement and authorisation letters, a named deconfliction contact reachable throughout, and every artefact we deploy logged, hashed, and listed in the report so you can verify nothing was left behind.
Red teaming is not a fixed-price package and we won't pretend otherwise. Cost depends on objectives, estate size, number of physical sites, and whether your defenders are informed. Expect a multi-week engagement and a corresponding investment—these are our largest projects. If a fixed-scope pentest is the better fit for what you actually need, we'll tell you on the call.
The two tests auditors and enterprise customers ask for most, run as one engagement with one report, one retest, and one attestation letter.
Most first-time pentest buyers are here because an auditor, a customer, or an insurer asked for one. It's worth being precise about what that request means—and what a security firm can and cannot do about it.
To be direct about the boundary: a SOC 2 report is an attestation issued by a licensed CPA firm. We are not your auditor, and no penetration testing vendor—including us—can make you "SOC 2 compliant." What we deliver is one specific piece of evidence your auditor files against the security criteria: an independent test of your systems, and proof you fixed what it found. Anyone who tells you otherwise is selling you something they can't deliver.
| What the auditor looks for | How the engagement delivers it |
|---|---|
| Independence | The test is run by SPM Tech operators with no hand in building or running your systems — the separation auditors require. |
| Scope matching the audit boundary | We test the system boundary your auditor has defined. Not less, which fails the audit — and not more, which wastes your budget. |
| A recognised methodology | OWASP WSTG and MASTG, PTES, and OWASP ASVS 5.0, documented in the report so the auditor can see the standard applied. |
| Severity-rated findings | Every finding carries a CVSS v3.1 rating, a CWE and ASVS mapping, and a plain-language business impact statement. |
| Evidence that issues were remediated | The part most vendors charge extra for: a free retest within 60 days and a reissued report showing each finding verified closed. |
| A test dated inside the audit window | We confirm your audit dates on the scoping call and schedule the engagement so the report falls inside the period under examination. |
Type I or Type II? A Type I report is a point-in-time snapshot of control design; a Type II covers how controls operated over a window, usually three to twelve months, and is what most enterprise customers ask to see. Either way the requirement on your side is the same—an independent test dated inside the period—so tell us your audit dates and we will schedule around them. The signed attestation letter we issue on completion is the document your auditor and your enterprise prospects will actually ask for, and it is included in the price.
The same applies to ISO 27001, PCI DSS, and customer security reviews. The certifying body differs and PCI DSS is stricter about frequency, but the artifact they want from us is identical: an independent, methodical, severity-rated test with documented remediation. One engagement typically satisfies several of these at once — mention every framework you are working toward on the scoping call so we scope it once rather than twice.
Things other firms upsell are part of the price here.
The operator who scopes your engagement is the one who runs it. Manual testing throughout—tools assist, they don't decide.
An executive summary your leadership and customers can read, plus CVSS-rated technical findings with concrete fix guidance for your engineers.
We walk your team through every finding, answer questions, and help you prioritize the fixes that matter first.
Fix the findings and we verify them at no charge—with an updated report showing the issues closed.
A signed attestation letter you can hand to your SOC 2 auditor, enterprise prospects, or cyber-insurance provider.
One 30-minute call to confirm scope. If your environment exceeds a package, you get the adjusted price before you commit—never after.
No. Scans are one input we use, but every engagement is manual testing by a senior operator—chaining findings, testing business logic, and validating what's actually exploitable. A "$2,000 pentest" is a scan with a cover page; that's not what this is, and it's why our prices start where they do.
Most engagements start within 1–2 weeks of scoping and run 1–2 weeks depending on the package. If you have an audit or customer deadline, tell us on the scoping call—we'll be honest about whether we can hit it.
Roughly an hour of your time: a scoping call, test credentials for grey-box work (app tests), a signed authorization form, and a technical contact in case we find something critical mid-test. We handle the rest.
Yes—the report and attestation letter are built for exactly that. Findings are CVSS-rated, methodology is documented against recognised standards (OWASP WSTG / MASTG / ASVS, PTES), and the free retest gives you a clean closing report to share. Note that we provide the independent test your auditor needs as evidence—the SOC 2 report itself is issued by a CPA firm. Full explanation here.
Listed prices are USD. We're based in British Columbia and happy to quote and invoice Canadian clients in CAD—just ask.
Yes—our sample report is published in full, no email required. Judge the quality yourself before spending anything; it's the best way to compare us against other quotes.
Tell us what you're building and what's forcing the test—an audit, a customer, an insurer, or good judgment. We'll confirm scope and send a fixed-price proposal within 24 hours.
Prices in USD · CAD quotes for Canadian clients · NDA available · Response within 24h