What should be considered when choosing a red teaming vendor?

Look for a vendor that builds each engagement around your organization's actual threat landscape rather than running a generic exercise. Ask about their methodology across all phases, from reconnaissance through post-exploitation, and confirm they use both commercially available and custom-developed tooling. Equally important is what happens after the exercise; the debrief and reporting process should ensure your technical and leadership teams both walk away understanding what was found, why it mattered, and what to fix first.