Bugcrowd Launches Red Team Service to Test Cybersecurity Defenses – Source: securityboulevard.com

Bugcrowd today at the 2025 RSA Conference announced its intent to create a red team service to test cybersecurity defenses using a global network of ethical hackers.

Alistair Greaves, director of red team operations for Bugcrowd, said via a Red Team-as-a-Service (RTaaS) offering that a global pool of experts vetted by Bugcrowd will employ the latest adversarial tactics, techniques, and procedures (TTPs) to simulate how adversaries might attempt to breach their defenses.

Bugcrowd already manages a platform through which organizations can offer bounties to independent cybersecurity researchers that are provided incentives to compromise defenses. The Red Team service takes that to the next level using a team of hackers tasked with specifically achieving that goal that have access to threat intelligence and risk profiling tools provided by Bugcrowd, said Greaves.

Cybersecurity and IT teams are then presented with comprehensive reports that include visual attack chains, attack narratives, and findings mapped to root causes and misconfigured security controls. Those teams can be contracted for a fee for a day or provided with other rewards to suit a range of needs, budgets, and objectives, noted Greaves.

The overall goal is to make it more affordable for more organizations to contract red teams to test their defenses in a way that goes well beyond basic penetration testing versus trying to hire and retain cybersecurity experts that have that level of expertise on their own, he added.

Bugcrowd is still recruiting Red Team members and, longer term, would like to add a Purple Team service that combines the expertise of attackers and defenders into a single service, said Greaves.

There are, of course, other red team services that cybersecurity organizations can contract, but Bugcrowd is counting on independent contractors to provide it with a pool of cybersecurity experts that can rotate between organizations every few months. That approach ensures that no one becomes familiar with an IT environment to the point where they might not be able to discern new threats, noted Greaves.

Each cybersecurity team will need to decide for themselves to what degree to rely on red teams to test their cybersecurity defenses but the one thing that is certain is that cybersecurity syndicates and nation states are now combining a range of tactics and techniques that have become more difficult to detect. Simulated attacks provide a means for uncovering weaknesses and vulnerabilities that, in many cases, have been overlooked. The simple fact is that it is all but impossible for cybersecurity teams to uncover every issue on their own.

Hopefully, more of those issues will soon be uncovered before they are exploited with the aid of artificial intelligence (AI) tools. However, adversaries are also likely to have access to similar AI tools that will, for example, make it much easier to ascertain how to exploit a specific vulnerability. No matter how advanced those tools become, however, there is when it comes to wreaking the maximum amount of havoc possible not likely ever to be a substitute for old-fashioned human ingenuity.