On July 18, the UK AI Safety Institute (AISI) published an evaluation. It scored mainstream open-source and closed-source models against the same set of cyber offense and defense test questions, and concluded that the cyberattack capabilities of open-source models have caught up to the level that top closed-source models had reached 4 to 7 months earlier, whereas in 2025 that gap was still 6 to 10 months.
What is truly striking is cost. In a simulated cyber range called "The Last Batch," running a single 100-million-token attack costs about USD 85 with the closed-source Opus 4.5 or 4.6, about USD 46 with the open-source GLM-5.2, and only USD 1.19 with DeepSeek V4-Pro. Allocated to a single attack task, Opus 4.5 costs USD 12.5 per run, while DeepSeek V4-Pro costs only USD 0.28.
On one side, capabilities are converging; on the other, costs have collapsed to near zero. AISI's assessment is that the preparation window left to defenders is narrowing. Translated into business terms, this becomes a more direct question: when the attacker's cost drops to less than the price of a cup of coffee, is the once-a-year testing cadence that enterprises have used for the past year still sufficient?
The answer is already written in domestic cases. In a retrospective, Anheng Information disclosed that it used an AI security-service digital employee called "An Xiaolong" to conduct a red-team exercise codenamed "Sharp Blade" for a bank, compressing work that traditionally takes two to three weeks into 7 days. According to its account, it fully inventoried all 327 external assets on the first day and replaced more than 80% of repetitive operations throughout the process.
Red-team services are beginning to shift from being sold by person-day to becoming a business backed by AI. Whether it is worth doing requires laying out the accounts and taking a look.
What is sold is not an attack model, but a report that can be delivered
First, let us be clear about what kind of business this is. Security companies sell banks, government and enterprise entities, platforms, and large-model application providers an AI-assisted red-team assessment: AI handles automated asset mapping, attack-chain attempts, and draft reports, while senior experts retain strategy formulation, vulnerability exploitation, and result review, charging per engagement or renewing as an annual subscription.
The key point is that what the client pays for is not the model that can attack. Tools such as Anheng's "An Xiaolong" are themselves sold externally; according to its official website, it carries more than 44 skills and can automatically invoke 67 penetration tools. Tencent Cloud's automated offense-and-defense service even lists unit prices explicitly in its documentation. If the client wanted only attack capability, it could simply buy the tool and run it itself; why pay an additional service fee?
What the client buys are four things that tools cannot provide: a graded report mapped to frameworks such as MITRE ATLAS and the OWASP Top 10 for Large Language Model Applications, a remediation loop from problem discovery to a 30-day retest confirming the fix, a licensed entity that can bear responsibility if something goes wrong, and the qualification recognized by regulators and auditors. The most valuable sentence in the Anheng case is not "took down the OA system's weak password in minutes," but "more than 70% of the high-risk vulnerabilities discovered were difficult for traditional manual work to find"—and this sentence likewise comes from Anheng's own retrospective. These findings generate value only when written into an evidence chain that can be delivered to regulators.
Pinning this business onto the industry chain, security service providers stand at the application layer closest to clients. Their upstream is not model companies—models have long been the party whose prices are being squeezed; what truly constrains them are tool and platform vendors. Here lies the most awkward structural feature of this business: Anheng both sells you the "An Xiaolong" shovel and personally enters the field to conduct exercises for banks; Tencent Cloud both sells offense-and-defense tools and directly takes orders using publicly listed prices. The shovel sellers may at any time go down the mine themselves—this point will be raised again later when calculating barriers.
The cost of materials is almost zero, yet the most expensive cost has not fallen at all
The accounts of this business must first look at the cost structure rewritten by AI.
Traditional red teaming is sold by person-days. Tencent Cloud publicly lists the unit price of its offensive and defensive confrontation services at RMB 26,700 per person-day, with a minimum engagement of three people for five days, amounting to RMB 400,500 per engagement; a company-level exercise of thirty person-days costs RMB 801,000; an industry-level exercise can reach seventy person-days, or RMB 1,869,000. Labor is the largest cost item in this business.
With AI entering the picture, the first thing it eats into is material cost. The figures above already show that the model cost of running a full evaluation set has fallen from tens of dollars to just over one dollar, and can almost be written off the books. The efficiency figures Anheng provides are even more intuitive: it claims that a site that previously required three person-days can now be completed in half a person-day to one person-day, also per the vendor's own account. On that basis, for a company-level project originally requiring thirty person-days, after AI takes over eighty percent of the repetitive operations, the experts' actual input may be compressed to six to nine person-days.
Here is the question: with both material cost and person-days having fallen so much, why can it still be sold for hundreds of thousands?
Because the client-facing quotation has not fallen along with it. Tencent Cloud's unit price of RMB 26,700 per person-day remains listed as before. In the tender market, CCCC Investment's large-model security assessment is RMB 150,000 per year, and Shenzhen Securities Communication procured three red team assessments in a single purchase, with a quotation ceiling of RMB 2,000,000 and a service period of three years. These prices are anchored to "one project" and "one year," not to how many tokens you actually burned or how many person-days you invested. The cost side has collapsed while the revenue side has not; this scissors gap in between is the entire reason the gross margin of this business currently looks good.
Based on a client-facing price of RMB 800,000 for a company-level engagement and an actual input of six to nine person-days, I made a rough calculation: the gross profit per engagement comes to RMB 500,000 to 600,000, with a gross margin of around seventy percent. This calculation is consistent with the quotations of US vendors: over there, a complete AI red team assessment, testing everything from the application to the retrieval layer and then to the agent layer, is quoted at USD 35,000 to 55,000, which converts to RMB 250,000 to 400,000; a quick check of a single system is USD 12,000 to 18,000; and within the publicly disclosed industry range, a per-engagement red team assessment is roughly USD 16,000 to 100,000.
But this seventy-percent gross margin figure warrants caution. It is sustained by "quoting the client at thirty person-days while actually doing only six." If one day the client's procurement sees through this, the quotation will be pushed down. The US price of USD 35,000 to 55,000 is already somewhat cheaper than the domestic company-level engagement at RMB 800,000. Those who can truly withstand price pressure are never the ones who tout AI efficiency the loudest, but those whom the client dares not replace and cannot afford to replace. This brings us back to the threshold.
The Ledger
The threshold has not fallen; it has instead been pushed to the qualifications side
A common misreading is that AI has lowered the threshold of the red team business. Quite the opposite.
The threshold should be viewed at two levels. The level of buying tools and connecting open-source models hardly constitutes a threshold: a model costs USD 0.28 per task, tool vendors such as "An Xiaolong" sell subscriptions directly, and with one or two experienced hands, you can get started on RMB 30,000 to 50,000 a month. But this level is only enough to take on scattered jobs; it cannot get you onto the procurement whitelists of government and enterprise clients.
The level at which large government and enterprise contracts can be signed has a threshold of RMB 300,000 to 3,000,000, and money is not the key—time is. Look at the bidder qualifications fixed in that Shenzhen Securities Communication tender: two system certifications, ISO27001 and ISO20000; Level 1 emergency handling and Level 1 risk assessment under the CCRC information security service qualifications (or Level 2 in the risk assessment category of national evaluation), plus CNCERT network security emergency service support unit status. This set of qualifications must be exchanged through years of historical performance and team size; a team that can call APIs cannot assemble them in three months. Without them, no matter how low the quotation, you cannot get through the tender door.
So the things that truly cannot be copied are none of them AI. Models are open source, tools are sold by vendors to anyone, and AI capability lags the closed-source frontier by only four to seven months and is still narrowing. In this business, AI is a commodity, not a moat. What cannot be copied are three things: the seasoned expert's judgment at the moment of a high-risk finding (after AI finishes reconnaissance, which vulnerability is worth digging into and how to conduct lateral movement cannot be written into a standard operating manual—whatever could be written has long since been automated), the trust that government and enterprise clients have accumulated over years (a bank's willingness to let you touch its core business zone does not rest on model parameters), and the qualifications and insurance that can bear responsibility when something goes wrong.
These three things are precisely what vendors selling tools and retail investors who can only fine-tune models cannot provide. For this very reason, the earlier concern about 'the shovel seller going down the mine himself' is in fact less frightening to established companies with the requisite qualifications: no matter how well Anheng or Tencent Cloud builds its tools, it cannot conjure up a CCRC Emergency Response Level 1 qualification, nor can it replace a bank's trust in a service provider it has worked with for years.
So the question in the title can now be answered: can AI red teaming turn person-day fees into subscriptions? The answer is a qualified 'yes.' Security firms can indeed renew one-off projects into annual continuous validation, or even a resident virtual security officer; the three-year contract with Shenzhen Securities Communication is exactly this form, with revenue shifting from a one-shot deal to predictable cash flow. But it cannot produce the zero-marginal-cost subscription of software: every retest still requires the person-days of senior experts. What you get is the revenue form of a subscription, not the cost form of a subscription. Anyone hoping to achieve SaaS-level gross margins through AI red teaming will be disappointed.
As for the ceiling of this business, extrapolating optimistically, the tier of domestic banks, licensed financial institutions, central and state-owned enterprises, and filed large-model manufacturers that require high-frequency retesting, estimated at RMB 300,000 to 800,000 per entity per year in security assessment spending, puts the market at roughly the scale of RMB one billion to several billion. It cannot reach RMB ten billion; the bottleneck is not demand but supply: service providers able to assemble that entire qualification checklist at once are inherently few. Moreover, seventy percent of this is newly added pie, the high-frequency retesting and annual validation forced into being by cheaper attacks, money that traditional person-day-based red teaming never could collect; only the other thirty percent is existing stock taken from traditional penetration testing. The stock-taking segment requires a price war; the incremental segment is still a blue ocean for now.
Barriers
Whom does this project leave an opportunity for?
For established security companies that already hold CCRC and MLPS qualifications, have banking and government-enterprise channels, and maintain senior red teams, this business is an easy win. What you have always lacked is not qualifications and channels, but embedding AI into the delivery process. AI helps you amplify the capacity of the same group of experts two to four times and renew one-off projects into annual subscriptions; the moat was dug long ago, and AI is merely the free excavator.
Small and medium-sized penetration testing teams with technical skills but no qualifications should observe and wait, but not sit idle. You can do the work, but you are blocked by bidding access and the entity bearing liability. Wait for two signals: first, you have accumulated enough historical performance to be eligible to apply for CCRC Emergency Response Level 1 and CNCERT support unit status; second, you find a licensed company lacking AI capabilities and form a stable prime-contractor/subcontractor relationship. Before those signals arrive, survive and accumulate performance as a technical subcontractor; do not force your way into direct contracting with the client. The fattest part, direct annual subscriptions, is not yet your turn.
Pure AI players who can only fine-tune models and want to take bank orders after buying tools should stay away. You lack all three of the hardest things in this business, qualifications, government-enterprise trust, and backstopping for unauthorized access, yet you stand precisely at the operational end where things most easily go wrong. The reason is written in this final reckoning below.
The non-negligible cost of illegality
The legal cost of this business is mainly a certain expense that can be calculated and paid off with money. To take on government-enterprise work, the set of qualifications mentioned earlier is a hard threshold; CCRC, MLPS assessment qualifications, system certifications, together with professional liability insurance, are all money that must be spent each year and can simply be booked as fixed costs. Large-model security assessment itself is also shifting from a bonus point in bidding to a hard-coded access requirement in procurements such as those of China Communications Construction, Shenzhen Securities Communication, and Digital Grid. This is good for companies that obtained qualifications early: when the threshold rises, those who comply first eat the market of those who comply later. This layer is a soft landing, solvable with money and time.
But there is one line that money cannot cover, and it must be drawn separately.
The premise for lawful red team testing is a written authorization that firmly frames the systems that may be touched, the times that may be tested, and the data that may be handled. Once a testing action goes beyond the scope of that authorization letter, scanning one more system not written into it, retaining one more copy of a client's sensitive data, the nature of the technical act flips on the spot, from 'service' to 'unauthorized access.' Within authorization it is called security assessment; outside authorization, the very same act corresponds to illegal intrusion and illegal acquisition of computer information system data under Article 285 of the Criminal Law, and destruction of computer information systems under Article 286; and if a client's sensitive data or citizens' personal information is copied out and goes out of control, Article 253-1 on infringement of citizens' personal information is stacked on top.
The 70% gross margin calculated earlier holds only within this line. Cross it, and the accounts must be recalculated: a single unauthorized access does not trigger mere compensation; it triggers criminal liability, revocation of the entity's qualifications, and the business going straight to zero. Multiply by this probability and then subtract the possible total loss, and for most people the calculation comes out negative. This is precisely why retail participants who rely purely on tools, without qualifications and insurance, should not touch this business. Insurance is sold to licensed entities; when something goes wrong, you are not in the position of bearing liability on behalf of the bank—you are simply the person standing in front of the keyboard who personally crossed the line.
The way to reduce legal risk is actually quite plain—just three points, all before taking action: in the authorization letter, specify the system list, time window, and data boundaries item by item, preferring narrow over broad; during testing, minimize retention of client data and destroy it immediately after use, avoiding any storage where possible; and route vulnerability disclosure through a written process, giving the client closure first and not spreading it externally on your own. Do these three solidly, and that criminal red line is basically untouchable, with legal costs returning to the calculable expense of "qualifications plus insurance."
Anyone with related legal needs—such as how to draft authorization boundaries, or how to design data retention and disclosure processes so as not to cross the line—is welcome to talk with the author.
