Most small and mid-sized companies can't staff an attack team or a defense team, so they staff neither and hope. RTBT does both, in the same week, with the same people — and hands you one report you can act on Monday.
Drag the seam. On the left is what a red team does. On the right is what the defenses actually see. The gap between them is the whole product.
Start wherever the pressure is. Most clients begin with an engagement, then keep the appliance.
A laptop arrives, a contractor gets a VPN account, someone opens a firewall rule on a Friday to make a printer work — and by autumn the report you paid for in spring describes a company that no longer exists.
RT-1 is how we sell a small company continuous testing without also selling them a security team. It stays after we go and keeps running the same attacks, safely, on a schedule.
The big firms sell you a 200-page PDF. You needed four sentences and a Tuesday afternoon.
The security industry is built for enterprises and priced for them too. The 30-person manufacturer, the regional clinic, the law firm with two offices — they face the same attackers and get sold either nothing or a program they have no way to run.
We keep the engagement small, the report short, and the fixes ones your existing people or your IT provider can actually make.
Thirty minutes. Tell us how many people you have, how many locations, and whether anyone has ever tested you before. If we're not the right fit we'll say so on the call.
Every engagement runs under a signed scope and authorization letter. Nothing is touched that isn't named in it.
RT-1 is a 1U appliance we rack in your closet. It re-runs the attack paths from your engagement on a schedule, safely and within agreed limits, and emails you the day something you fixed comes back.
Nobody gets breached the week after a penetration test. They get breached eight months later, through something that wasn't there when the testers were.
A new laptop with the old image. A contractor's VPN account that outlived the contract. A firewall rule someone opened on a Friday to make a printer work. Every one of those is small, reasonable, and invisible — and together they rebuild the attack path you just paid to close.
RT-1 watches for exactly that. It knows the paths that worked on you, because it was built from your engagement, and it walks them again every week.
Why not software?
Because the honest test comes from inside, on your network, from a machine that isn't yours to reconfigure. An agent installed on your servers gets whitelisted, excluded, and eventually turned off by whoever is troubleshooting something else. A box in the rack is harder to quietly defeat — which is the point of a red team.
The exact routes our team used during the engagement, run again on a schedule you set. If a closed door reopens, you hear about it in days rather than at the next annual test.
New devices, new open services, new shares, new accounts with more access than they need. The stuff that appears between tests because a business is a living thing.
A detection rule that nobody has fired in six months is a rule you should not trust. RT-1 sets them off on purpose so you learn whether they still reach a human.
A short weekly email to you and to whoever runs your IT. New findings, resolved findings, and what changed since last week. Not a dashboard you'll stop logging into.
This is the part most clients want in writing, so it goes in the contract too. An appliance that attacks your network is only acceptable if its boundaries are absolute.
The techniques it runs are chosen for safety and agreed in scope before deployment. Anything with a real chance of disrupting a service is excluded from automated runs and only ever done by a person, during an engagement, with you on the phone.
That said, no honest vendor tells you the risk is zero. It's low, it's bounded, and there's a switch on the front of the box.
Good — they get the weekly email too. RT-1 tends to make a decent IT provider look better, because it hands them a short specific list instead of a vague worry. We are not trying to replace them and we don't sell managed IT.
Yes. RT-1 is built from your engagement's findings; without one it would be running generic checks, which is a different and much less useful product. The first test is what teaches the box what your network actually looks like.
No standing credentials are required. Where a scenario calls for an account — testing what a compromised employee could reach, for example — you create a dedicated test account with defined access and can disable it at any time.
It's a monthly subscription that includes the hardware, the weekly runs, and the reporting. Pricing depends on how many sites and how many addresses are in scope, so it comes out of the scoping call rather than a table on a website.
Most companies should start with an engagement and decide about the appliance at the readout, once they've seen what we found. We'll tell you honestly if a box in your closet isn't the thing you need.
Attack and defense are usually sold by two different firms who never speak to each other. We run them as one engagement, because finding the hole and closing it are the same job.
The part clients tell us they didn't know they could buy. We sit in the same room as your staff or your managed IT provider. We run an attack, everyone watches what fires and what doesn't, we tune the rule, and we run it again until it catches.
It is the fastest security training we know of, because nobody is being lectured — they're watching their own network get taken apart and putting it back together as it happens. That knowledge stays after we go, which matters more for a small company than any document we could leave behind.
For the owner or the board. What we found, what it would cost you if someone else found it first, and the three things to fix this month.
For whoever does the fixing. Each finding has the path we took, the evidence, and the specific change to make — not a link to a vendor's documentation.
Working rules for the tools you already own, plus a note on what your current tooling genuinely cannot see, if that turns out to be the case.
We do not sell software licenses, we don't take vendor commissions, and we don't sell you managed IT afterwards. If the right answer is that you should spend nothing and change two settings, that's what the report will say.
The scoping call is thirty minutes and it's how we work out which of the above you actually need. Often it's less than people expect.
Numbered because the order matters. Re-testing before fixing tells you nothing, and fixing before attacking means guessing at what to fix. Most engagements run four to six weeks end to end, of which yours takes about six hours of anyone's time.
We ask what you have, where it is, and what would genuinely hurt if it stopped for three days. Then we write down what's in bounds, what's out, when we can touch things, and who to call if something goes wrong. You sign that document and an authorization letter before anything starts.
This is also where we tell you if you don't need us yet. It happens.
The red team works the scope. In most engagements your people notice nothing, which is itself a finding. You get a phone number that reaches a human at any hour, and we stop the moment you say stop — no discussion, no change order.
If we find something severe enough that waiting would be irresponsible, we don't save it for the report. You get a call that day.
We walk you through what we did, in the order we did it, so the story makes sense rather than arriving as a list of severities. Findings are ranked by what a real attacker would do first — not by a scoring formula that puts a theoretical issue above the unlocked door.
Bring whoever will do the fixing. Bring the owner. The point is that everyone hears the same version once.
This is the part most firms leave to you. Our blue team works with your staff or your IT provider: detection rules written and tuned, settings changed, backups tested, playbook drafted. If you want purple week, this is where it sits — same room, attack and defense side by side.
We work at your pace. If your one IT person has a busy fortnight, the fix window moves.
We run the same paths again and show you which are closed, which are partly closed, and which you decided to accept — because accepting a risk knowingly is a legitimate business decision and the report should record it as one.
If you keep RT-1, this becomes continuous instead of a moment. That's the whole argument for the appliance.
Less than you'd think, but the last item is not optional and we'd rather say so before you sign anything.
Every engagement is governed by a scope document and a signed authorization letter. These are the standing terms inside it.
No encryption, no deletion, no denial of service against production. Impact is demonstrated, not performed.
Where proof requires evidence, we capture the minimum needed and destroy it on an agreed schedule after the report is delivered.
Any named contact can halt the engagement at any hour with one call. We stand down first and ask questions afterwards.
Anything actively exploitable and severe gets reported the same day rather than held for the readout.
Your cloud providers, your suppliers, and your customers are not tested without their own written permission.
Phishing results are reported as rates and patterns. We don't hand you a list of names to discipline, and we'll push back if you ask.
Engagements are quoted as a fixed fee after the scoping call, based on the number of sites, the number of addresses in scope, and which of the red and blue components you want. No hourly billing and no discovering a bigger number halfway through.
The RT-1 appliance is a separate monthly subscription that includes the hardware, the weekly runs, and the reporting.
If the scope changes, we re-quote before doing the work, not after.
A note on cheaper options
You can buy an automated vulnerability scan for a fraction of this, and for some companies that is genuinely the right first purchase. It will find missing patches. It will not find that your backup server accepts your help desk's shared password. If a scan is what you need, we'll say so on the call.
Thirty minutes, no obligation, and no deck. The worst outcome is that you learn what you'd be buying.
RTBT is a red team and blue team practice built for the companies the security industry quietly writes off: too small for an enterprise program, too real to be told to buy antivirus and hope.
The big firms sell you a 200-page PDF. You needed four sentences and a Tuesday afternoon.
The security industry is built for enterprises and priced for them too. A 30-person manufacturer faces the same ransomware crews as a bank — more often, in fact, because the crews know the manufacturer has no night shift watching alerts — and gets offered either nothing, or a program that assumes a team it will never have.
So the small company buys a tool, the tool sends alerts to an inbox nobody reads, and everyone agrees that security has been handled.
We started RTBT to sell the other thing: a real attack, run by people, followed by real fixes made alongside your own staff, and a box that keeps testing after we leave. Small scope, short report, and a phone number that reaches a person.
There is no account layer between you and the technical work. The people in your network are the people at your readout.
Dowell runs the technical side of RTBT: the engagements themselves, the tooling behind them, and the design of the RT-1 appliance. He is the person who will be in your network, and the person who will explain what he found.
His view of the work is simple — a finding you don't understand is a finding you won't fix. So every report gets written to be read by whoever has to act on it, not by another consultant.
"Most of what we find isn't clever. It's a password from 2019 that still works. The clever part is noticing before somebody else does."
Dowell Stackpole
No software licenses, no vendor commissions, no reseller margin. If the right answer is to change two settings and spend nothing, the report will say that. Our incentives should not depend on your problem being expensive.
Findings get written for the person who has to fix them and the person who has to fund it. If a sentence in our report needs a glossary, it goes back for a rewrite.
Some companies who call us should buy a scan, turn on multi-factor authentication, and check back in a year. We'd rather say that on the first call than take the money.
Phishing results come back as rates and patterns, not a list of names for a manager to punish. People who fear being blamed stop reporting things, and reporting is the control that actually works.
What's in bounds is written down and signed before anything begins. We don't test what we weren't authorized to test, however tempting the open door looks.
Detection rules, playbooks, and baselines are yours. Nothing is locked to us, and nothing stops working if you don't renew.
Red team, blue team. Attack and defense — the two halves of security that most companies are sold separately, by firms who never talk to each other, at a price that assumes you can afford both.
The seam between them is where the value is. In the industry it's called purple teaming, and it's the part we think small companies need most, because you can't afford for the lesson to be lost in the handoff between two vendors.
The scoping call isn't a sales call with an engineer brought in later. You get the person who'll be doing the work, in the first thirty minutes.
Thirty minutes with the person who would run the work. No deck, no discovery process, no follow-up sequence. If we're not the right fit we'll say so on the call and tell you what we'd do instead.
If you think you're being attacked right now, don't fill in a form. Call your cyber insurance carrier's incident line first — using them is usually a condition of your coverage — and disconnect affected machines from the network rather than powering them off. Then reach us at hello@rtbt.ai. A test is not what you need today.
Use the number on your engagement letter. It reaches a person at any hour for the duration of your engagement.