![The Red Room Council](data:image/svg+xml,<svg xmlns="http://www.w3.org/2000/svg" width="490" height="490"><rect fill-opacity="0"/></svg>)
Offense
Red Team & Pen-Testing
Full-scope intrusion campaigns across cloud, network, hardware, physical entry and social engineering, run by cleared operators.
Introducing Red Silk
Breach it first
Red Silk turns adversary simulation into a continuous signal. Get the monthly council briefing on live intrusion paths, audit findings and the tradecraft behind them.
Read the manifestoTrusted inside regulated institutions
Meridian ClearingHalcyon Federal BankCastellan EnergyNorthgate ExchangeOrbis Health SystemsSable Sovereign Fund
480+
Adversary engagements delivered
37
Zero-days disclosed responsibly
$2.4B
Assets traced in forensic audits
6 hrs
Median time to first foothold
The Council
Adversarial discipline for
institutions that cannot afford to be surprised.
The Red Room Council is a closed bench of offensive operators, forensic auditors and former regulators. We break systems on purpose, document exactly how, and stay in the room until the finding is closed.
Red Silk · Now in council preview
Red Silk keeps a live adversary inside your estate, replaying real intrusion chains every day instead of once a year. Every path it proves comes with the evidence, blast radius and the fix your auditors will ask for.
Offense x Assurance
Choose your adversary
We model the threat actor that actually wants you: a ransomware crew, an insider with signing rights, a state team with patience. Each engagement is scoped to one adversary profile and run end to end, from initial access through exfiltration.
Prove the control
Findings land as audit-grade evidence: reproducible attack paths, mapped controls, and a remediation ledger your board and your regulator can both read. Nothing closes until we re-run the attack and it fails.
What we do
Our practices
Assurance
Audit & Investigation
Forensic audits, fraud reconstruction and regulatory investigations, delivered as evidence that survives counsel and a hearing room.
Why boards keep the council on retainer
Continuous, not annual
Red Silk re-runs your adversary profile every night, so a control that drifts on Tuesday is caught on Tuesday.
Audit-grade evidence
Every finding ships with reproduction steps, mapped controls and screenshots your assessors can cite verbatim.
Signal over noise
We report proven attack paths, not scanner output. If it cannot be exploited, it does not reach your board pack.
Six hours to foothold
Median time from engagement start to first proven foothold, with your defenders scored live on detection.
A named bench
You work with the same operators and auditors across engagements. No rotating juniors, no handover loss.
Closed means closed
Remediation is verified by re-attack. A finding stays open on your ledger until the exploit reliably fails.
Landmark investigation
The end of Mehman Brothers
The council was retained to reconstruct eleven years of off-ledger exposure. Hiro Bourne presented the audit in a single sitting: every transfer traced, every signature matched, every control that was supposed to stop it named. The firm did not open the following Monday.
Hiro Bourne, Head of Forensic Audit, presented 2,140 pages of findings without a single contested exhibit.
Hiro Bourne
Head of Forensic Audit
From the rooms we were called into
“They were inside our payments path in under a day, then spent three weeks making sure we could prove it never happens again. Our regulator accepted the ledger without a follow-up.”
Ingrid Salas
Chief Information Security Officer, Halcyon Federal Bank
“Red Silk replaced a stack of annual reports with one screen the board actually reads. When a control drifted during a migration, we heard about it the same night.”
Dmitri Vance
Group Head of Security, Castellan Energy
Engagement terms
Every engagement begins with a scoping session under NDA. Pricing below reflects standard council rates for a single legal entity.
Assessment
$48k
per engagement
A scoped adversary campaign with a full findings ledger.
- One adversary profile, full kill chain
- External, cloud and application scope
- Audit-grade findings ledger
- Remediation re-test within 90 days
Red Silk
New$9.5k
per month
Continuous adversary simulation with the council on call.
- Nightly replay of proven attack paths
- Live control-drift alerting
- Quarterly deep-scope campaign
- Named operator bench and Slack channel
- Board and regulator reporting pack
Chamber
Bespoke
retained counsel
Investigations, forensic audit and crisis response on retainer.
- Forensic audit and fraud reconstruction
- Expert testimony and regulatory liaison
- Physical and insider-threat operations
- 24/7 incident escalation line
Before you retain us
The questions security committees ask us most often. Anything more specific belongs in a scoping call.
We open with a two-hour scoping session under NDA, agree one adversary profile and the rules of engagement, then issue a written mandate naming every in-scope asset, escalation contact and stop condition before an operator touches anything.
A pen-test is a snapshot. Red Silk keeps the proven attack paths from your last campaign running nightly against your live estate, so configuration drift, a new exposed service or a lapsed control surfaces in hours rather than at the next audit cycle.
A named bench of council operators and forensic auditors, all cleared and all directly employed. You meet them in scoping and they stay with your account across engagements. We do not subcontract offensive work.
Yes. Every finding carries reproduction steps, timestamped evidence, mapped controls and a remediation entry that stays open until we re-run the attack and it fails. The same ledger format was used in the Mehman Brothers investigation.
Destructive actions are excluded by default and every campaign runs with an agreed stop word and a live escalation line. Where production risk is unavoidable, we mirror the environment and prove the path there first.
Request access
Find out how you’d be breached
Red Silk is opening to a limited council preview. Send us the entity and the estate, and an operator will come back within two business days with a scoping window.
Prefer email? support@example.com