Control 20 of the CSIS 20 Critical Security Controls Penetration Tests and Red Team Exercises. My bet is that most organizations dont need to hire a dedicated penetration testing team. My recommendation is to find a reputable group of people that do this day in and day out. Have some internal security guys geek out with the red team for a while before, during, and after theyll learn from it. But, you’ll probably get more for your dollar by outsourcing this function.”]