AI red teaming engagement models and what drives the cost
AI red teaming is sold in four ways: a scoped manual engagement, a software subscription for automated testing, a crowdsourced competition or bounty, and a research partnership. Cost follows scope, which is why BlackCard quotes after a free 15-minute call. The main drivers are the size of the attack surface, the depth of manual work, the level of access and whether a retest is included.
The four engagement models
| Model | How it is charged | What is included | Best suited to |
|---|---|---|---|
| Scoped manual engagement | Fixed fee based on tester-days | Expert testers, a findings report and usually a retest | A new application or agent before launch, or an audit a third party will read |
| Automated testing subscription | Annual licence, often priced by number of applications, models or test volume | Repeatable attack suites that run on every release | Teams that ship changes weekly and need regression testing |
| Competition or bounty | Prize pool plus a platform or management fee | Many independent attackers and a wide range of techniques | Model developers and vendors who want breadth and can share access |
| Research partnership | Negotiated, sometimes unpaid for non-profits | Deep evaluation of a model, often with published results | Frontier model developers before a major release |
What drives the price of a manual engagement
A manual engagement, the model BlackCard works in, is priced like other security testing: the number of skilled people multiplied by the number of days. The following factors decide how many days are needed.
- Target type. A single chat interface is the smallest target. A retrieval system adds the document store. An agent with tools adds every action it can take and every system it can reach.
- Number of harm categories. Testing for data leakage only is quicker than testing for leakage, harmful content, fraud, unsafe actions and bias together.
- Access level. Black-box testing through the public interface takes longer to reach the same findings than testing with system prompts, architecture diagrams and logs in hand.
- Languages and modalities. Each additional language, and each of image, audio or file input, widens the work.
- Seniority and scarcity. Testers who understand both offensive security and machine learning are few, and their day rates reflect that.
- Reporting and retest. An executive summary, a technical report, a debrief and a retest after fixes each add time.
- Environment preparation. Agent testing may need a sandbox with realistic data and tools, which someone has to build.
What drives the price of a subscription
Automated platforms follow software pricing. Vendors usually charge by the number of applications or models under test, the volume of test traffic, or the number of protected endpoints when runtime protection is bundled. Enterprise features such as single sign-on, private deployment and support levels raise the price further.
Running the tests also consumes model tokens on your own account. A large attack suite sent to a paid model on every build can produce a noticeable usage bill, so ask the vendor how many requests a full run sends.
One-off test or continuous programme
A single test describes the system on one date. Models are updated, prompts are edited and tools are added, and each change can reopen a hole that was closed. For that reason many organisations combine the models: a manual engagement before launch and after major changes, automated tests in the release pipeline, and runtime monitoring in production.
The combined approach costs more in year one than a single test. It is usually cheaper than repeating a full manual engagement for every release.
How to compare quotes
- Check that every quote covers the same targets, harm categories and access level.
- Ask how much of the work is manual and how much is tool output.
- Ask who the testers are and speak to them before you sign.
- Confirm whether a retest is included and how long after delivery it may take place.
- Ask what happens to your prompts, logs and findings after the engagement ends.
- Ask for a sample report with client details removed.
Free and low-cost starting points
Teams with a small budget can begin with open-source tooling before paying for outside help. The UK AI Security Institute publishes the Inspect evaluation framework, and Promptfoo remains an open-source testing tool after OpenAI announced its acquisition in 2026. These tools need in-house skill to configure and interpret. They work well as a baseline that makes a paid engagement shorter and more focused. BlackCard hands over its attack prompts in a reusable form, so they slot into the same regression setup.
Common questions
Why do AI security labs not publish prices?
Because the effort depends on scope. An agent with ten tools and access to customer records needs far more testing than a public FAQ bot. Describe your system to BlackCard on a free 15-minute call and you get a scope and a quote that fit it.
Is automated red teaming enough without human testers?
For regression testing, yes. For a first assessment of a new or high-risk system, no. Automated suites repeat known attack patterns, while human testers find chains of weaknesses specific to your design.
How long does an AI red teaming engagement take?
A scoped test of one application commonly takes from one to a few weeks of testing plus reporting time. Frontier model evaluations and multi-agent systems take longer. The provider should give the duration in tester-days.