AI red-teaming services
An AI red-teaming service pays skilled people, and increasingly automated tools, to make your model or agent do what it should not: break policy, reveal its instructions, misuse tools. You get back a list of the attacks that worked, how to reproduce them and how serious each one is.
Last verified 7 November 2026.
Which companies sell AI red-teaming?
6 companies on our list describe red-teaming, safety testing or guardrails on their own pages. None publishes a red-team price. AI Evaluation Companies has no affiliation with, and no endorsement from, the firms named; everything here is drawn from what they publish.
| Company | What it sells for evaluation | Delivery | Published pricing | Security claims on its own page |
|---|---|---|---|---|
| Giskard | Agent testing and continuous red-teaming, with an open-source Python library | Software you run | Open-source edition free (runs locally); Professional plan price not shown | Not published |
| GalileoOwner: Cisco (acquisition completed May 2026) | Evaluation, observability and guardrails for AI agents | Software you run | Not published | Not published |
| Toloka | Auto-verifiable evaluation tasks, preference data and red-teaming; based in Amsterdam | Managed service | Not published | Not published |
| TELUS Digital | GenAI post-training data and red-teaming; says it has a 1M+ contributor community | Managed service | Not published | Not published |
| Gray Swan AI | Shade for red-team testing, Cygnal for input and output filtering, and Arena, a red-teaming network it says has 23,000+ participants | Platform and services | Not published | Not published |
| Centific | AI Data Foundry: preference data, SFT, RL environments and safety evaluation | Platform and services | Not published | Not published |
Disclosure: vendors in this table can pay us a fee when an introduction we made ends in a signed deal. The listing, its order and its wording are never for sale.
Haize Labs, a red-teaming startup, was acquired by Beacon in September 2026 and is left off until it is clear whether it still serves outside clients.
What does a red-teaming engagement deliver?
The deliverable is evidence, not a grade. Ask for these in the statement of work:
- Every successful attack with the exact input, the output, the model version and the date.
- A severity rating against your own policy, with the reasoning written down.
- Coverage: which categories were tried and how hard, including the ones that found nothing.
- The attack set itself, so your team can turn it into a regression suite.
- A retest of fixed issues, priced in advance.
Human red-teamers or automated attacks?
Automated tools generate thousands of known attack patterns cheaply and rerun them on every build. Human testers chain small weaknesses into one that matters, and they adapt when the model refuses. A sound plan uses automation for breadth and people for depth, then folds what people found back into the automated set.
How should you scope a red-team?
Name the harms first
Write the five or six outcomes that would be worst for your product: an exposed system prompt, a tool call that deletes data, advice your policy forbids. Testers spend their hours there.
Say what the system can reach
An agent with email, files and payments has a far bigger attack surface than a chat model. List every tool and data source, and give testers synthetic accounts rather than real ones.
Fix the rounds
One round before launch, one after fixes, then a smaller round per major release is a common rhythm. Agree the retest price before the first round starts.
Who else evaluates frontier systems?
Independent research groups also run evaluations of the most capable systems. METR, a nonprofit that studies frontier agent capabilities and works with AI developers on evaluations, says on its about page: "METR has not accepted funding from AI companies." Its work is useful background, but it is not a vendor you can hire for a product launch.
Questions teams ask
How much does AI red-teaming cost?
None of the red-teaming vendors we list publishes a price; each quotes per engagement. What moves the quote is the number of attack categories, whether testers need domain expertise, how many rounds you want and whether the target is a chat model or an agent with tools.
Is automated red-teaming enough?
It is good for coverage and for rerunning known attacks on every release (Giskard sells continuous red-teaming with an open-source library). People still find the attacks nobody has written down yet, so most teams use both.
What access does a red-team need?
Usually a staging endpoint that behaves like production, your usage policy, and a list of tools or data the system can reach. Do not hand over production customer data; give testers synthetic accounts.
Can we run a public red-teaming event instead?
Some firms run large participant networks for this. Gray Swan AI, for example, says its Arena network has more than 23,000 participants. A public event finds breadth; a contracted team gives depth and confidentiality.
Do you test the red-team vendors?
No. This page summarizes what each company publishes about itself, read on the date shown. We do not audit vendors or run trial engagements.
Pages that pick up from here
- Red-teaming vs benchmarking: what are you buying?
- Types of AI evaluation where safety testing sits among the four
- Vendors and tools the full list with published prices
Where these facts come from
- giskard.ai: Giskard pricing page; as seen on 7 November 2026
- blogs.cisco.com: Cisco blog on the Galileo acquisition; as seen on 7 November 2026
- toloka.ai: Toloka about page; as seen on 7 November 2026
- telusdigital.com: TELUS Digital data for AI training page; as seen on 7 November 2026
- grayswan.ai: Gray Swan AI about page; as seen on 7 November 2026
- centific.com: Centific AI Data Foundry page; as seen on 7 November 2026
- metr.org: METR about page; as seen on 7 November 2026
- thenextweb.com: The Next Web, Beacon acquires Haize Labs; 17 Sept 2026
Get a quote
Company ZIP first, then a contact, then the evaluation itself. A few lines tell us which vendors are worth naming.
We are an introduction service, not an evaluation vendor, and we may be paid by the company we introduce you to.
Please do not paste prompts, logs, model outputs or any other data here. Describe the project in words; data only ever moves under a contract you sign with the vendor.
Brief received.
Here is what happens next:
- We read the brief and check it against the vendors' published offers and limits.
- We email you the names of the vendors that fit and why, with links to their own pages.
- Reply yes to the ones you want to hear from. Anyone you do not pick never sees your details.