notthefed.com

What It Is

NotTheFed is a cloud and cybersecurity consulting team whose core positioning is to “act like an attacker.” It provides services such as vulnerability assessments, external/internal network penetration testing, phishing simulations, red-team tactics, and realistic threat emulation for businesses. The site repeatedly emphasizes that compliance alone is not enough: security assessments should go beyond PCI, FIPS/NIST, and similar compliance checks, focusing more on real attack paths and exploitable risks.

Core Capabilities and Deliverables

Its protection model is mainly based on offensive security validation. External penetration testing assesses an organization’s internet-exposed attack surface; internal penetration testing uses secure remote access to examine internal network risks; phishing-as-a-service simulates social engineering attacks and can be combined with security awareness training to reduce employee click-through and data leakage risks. The service appears to be delivered primarily through hands-on consulting by experienced specialists, rather than simply producing scanner-generated output. On the deliverables side, NotTheFed says it provides clear reports, reproduction steps, remediation recommendations, and can perform validation after customers complete fixes.

Pricing and Service Experience

Pricing is not publicly listed. The official site says the team has low overhead and stable costs, that most projects take less than a week, and that retainer service rates with capped hours can be negotiated. Customer testimonials repeatedly mention reasonable pricing, fast turnaround, and strong communication, making it particularly suitable for SaaS companies or startups that are budget-sensitive but still need professional penetration testing. Team qualifications include CISSP, CPT, ENCE, CEH, IAM, PMP, ITILv4, and others. A 24-hour contact is also offered, with project management and communication standing out as clear selling points.

Pros and Cons

The strengths are its extensive red-team experience, coverage across external networks, internal networks, SaaS, mobile, and phishing exercises, and its emphasis on real-world attack techniques and manual validation. It should appeal to teams that need annual penetration testing or pre-launch security assessments. The drawbacks are the lack of standard packages, pricing tables, a customer portal, real-time alerting, or information about a continuous monitoring platform. Its compliance credentials appear to be mainly at the individual certification level, with no clear mention of company-level certifications or formal audit capabilities for specific regulatory frameworks.

Who It’s For and Access from China

NotTheFed is better suited to overseas companies and technical teams that need third-party penetration testing, red-team assessments, SaaS security reviews, phishing exercises, or attack emergency analysis. Access from mainland China, payment methods, contracting entity, and local support are not disclosed, so buyers should confirm network accessibility, payment, and legal compliance matters by email before procurement. If Chinese-language deliverables, local compliance, or MLPS-related services are required, domestic alternatives such as DBAPPSecurity, NSFOCUS, Venustech, and Qi An Xin may be worth considering.