RFI - Offensive Security Testing Services

This is a Request for Information (RFI) to gather information from vendors capable of providing Offensive Security Testing Services for the NYS ITS-Chief Information Security Office (CISO). The goal is to explore a range of testing services that provide cutting edge security and efficient management of testing services to avoid any potential threats to NYS ITS. The ITS CISO Cyber Command Red Team is currently a hands-on, manual penetration testing team that simulates real-world attacks to find and exploit vulnerabilities that automated scanners can miss. The Red Team conducts comprehensive context aware testing of an application’s business logic, authentication, and access controls. The testing uses a suite of specialized tools including, but not limited to: Burp Suite, Metasploit, network reconnaissance toolsets, command and control frameworks, and custom tooling developed in a variety of scripting and programming languages. The Red Team concludes an engagement by providing a detailed and actionable report. The NYS ITS – Chief Information Security Office is seeking responses from vendors capable of delivering Offensive Security Testing Services that focus on practical, hand-on assessment tools.  NO AWARD WILL BE MADE This RFI is for planning and informational purposes only and does not constitute a commitment to a future procurement.   RFI C000942 - Offensive Security Testing Services will also be published at https://its.ny.gov/competitive-procurement-opportunities . Due date:12/10/2025 5:00 PM County(ies): All NYS counties Location: All NYS counties