Available on the Bugcrowd Platform, RTaaS works seamlessly alongside offerings such as Penetration Testing as a Service, Managed Bug Bounty, and Vulnerability Disclosure Programs. Bugcrowd customers can tailor their RTaaS engagements to meet specific needs, budget constraints, and organizational maturity. Through Bugcrowd’s global talent pool of vetted, trusted ethical hackers, customers can secure the exact expertise they need and scale their RTaaS program over time, surpassing competing services on the market today.

“Traditionally, red teaming was only possible for large organizations that could either afford the services of security consultants or had a sizable security workforce to manage the workload alongside daily operations—and even then, findings were too often not actionable. Bugcrowd’s industry-first offensive crowdsourced RTaaS bridges this critical security gap, opening the door for our customers to access high-end capabilities that deliver crucial insights into their defensive posture—continuously,” says Dave Gerry, CEO of Bugcrowd. “Bugcrowd was founded on the bug bounty hunter mindset, an objective that aligns perfectly with Red Team operators. This launch is a significant milestone for Bugcrowd as it brings a pioneering solution to life. We are excited to see the power of The Crowd in action in RTaaS and enhance our customers’ always-on approach to security testing.”

Due to the persistent and sophisticated campaigns of cybercriminals, the cost of breaches continues to rise. As enterprise environments become more complex, organizations understand the need to stay ahead of these advanced threats. While pen testing and bug bounties will remain crucial tools in identifying vulnerabilities, Bugcrowd RTaaS enhances organizational preparedness by simulating real-world attacks, allowing understanding of detection and response capabilities, and exposing gaps in security controls that traditional testing may miss.

“As a hacker, I’m genuinely excited about Bugcrowd’s new Red Team as a Service (RTaaS) offering. RTaaS builds on the strengths of traditional bug bounty and Penetration Testing as a Service, taking them to the next level by allowing organizations to safely test their defenses against real-world attack scenarios,” said Matt Byrdwell, aka Nerdwell, ethical researcher and hacker at Bugcrowd.” Red Teaming is the most effective way to evaluate how well an organization’s layered security controls work together to create a true defense-in-depth strategy—and to safely identify any gaps. By simulating realistic attacks in a structured, controlled environment, RTaaS is a great way for cybersecurity teams to demonstrate the value of a strong security posture to both the business and its leadership.”

Key features of RTaaS on the Bugcrowd Platform:

• Threat intelligence aligned with realistic scenarios: Bugcrowd RTaaS Integrates threat intelligence and risk profiling to simulate realistic, regulation-ready scenarios.
• Real-world adversarial tactics: Operators mimic the behaviors of nation-state actors, organized cybercriminals, and insider threats to authentically test an organization’s ability to detect, respond to, and contain advanced attacks.
• Global pool of specialized operators: Access a diverse network of vetted operators skilled in advanced tactics tailored to your environment and threats.
• Integrated platform and workflows: Receive comprehensive reports with visual attack chains, attack narratives, and findings mapped to root causes and security controls.
• Scalable and flexible: Capitalize on assured, blended, or continuous red team operations to match various budgets, regulatory obligations, and security maturity levels.
• High return on investment: Take advantage of flexible pricing options, including day-rate engagements, reward pools, and continuous programs, to suit a range of needs, budgets, and objectives.

Bugcrowd’s RTaaS is now available to all customers on the Bugcrowd Platform.

Continuous Attack Surface Penetration Testing (CASPT) is designed for customers with an evolving attack surface that only do pentesting once or twice a year, leaving “assets in motion” and at risk for new threat exposure, while being unprepared to address it immediately. With CASPT, users can run a baseline test and then share incremental changes about new and updated assets or threats with a curated team for testing as soon as changes are detected.

Fewer than 10% of organizations have full visibility into their evolving attack surface, yet nearly 70% have been compromised through an unknown or poorly managed asset – which suggests that adversaries know more about their attack surface than their defenders do. Organizations need to understand ongoing risk across all digital assets “in motion” before attackers can exploit them.

CASPT is enabled by Bugcrowd’s recent acquisition of Informer, a leading provider of external attack surface management (EASM) and continuous penetration testing. This integration combines detailed asset data acquired through EASM with the massive amount of vulnerability information Bugcrowd has processed in the past twelve years to create new and unique value for customers and hackers alike on the platform. Bugcrowd customers with managed bug bounty engagements will gain the ability to manually or dynamically update scope to account for new and updated assets. They can also kick off a new pentest or bug bounty engagement for specific assets directly from their EASM dashboards.

“Our long-term vision for our platform is to continuously give customers proactive, data-driven insights and recommendations so that they have eyes on their attack surface better than their adversaries do,” said Dave Gerry, Chief Executive Officer of Bugcrowd. “At the same time, our goal is to help the brilliant hackers on our platform acquire more skills and earn more rewards by matching them with engagements that precisely reflect their interests and experience. Our ability to bring rich EASM data into the Bugcrowd platform is an important milestone in this journey and we’re excited for what’s to come.”

Bugcrowd offers a unified platform for EASM, EASM-enriched penetration testing, and EASM-enriched crowdsourced testing. Standalone EASM providers, crowdsourcing providers, and traditional pen-test providers provide pieces of the solution, but none provide a complete one.

“Attack surfaces are not static – they are constantly expanding and shifting due to shadow IT, cloud adoption, multinational organizations, and M&A, making the manual tracking of digital assets an ongoing challenge,” said Julian Brownlow Davies, Vice President of Advanced Services at Bugcrowd. “Continuous Attack Surface Pen Testing provides customers with a uniquely high level of assurance that both compliance and risk reduction goals are being met, continuously. Our mission is to be a trusted partner providing proactive, data-driven insights that will arm them with what they need to defend their organizations.”