Black Hat Reviews
Done Differently

A Black Hat Review looks outward at your competitors before the RFP; a Red Team looks inward at your own draft proposal after it’s written. A Black Hat predicts rival solutions, teaming, and pricing so you can shape your strategy 4–8 months out. A Red Team evaluates your submission against Section M as a government evaluator would, typically weeks before submission. They answer different questions at different points, and a Red Team cannot recover a strategy a Black Hat would have corrected.

A high-realism Black Hat simulation predicts how a specific competitor will bid a specific RFP; a SWOT analysis is a static summary of who they are and what they’ve won. A high-realism simulation is dynamic; it predicts the competitor’s technical solution, management approach, and pricing strategy for a specific RFP. By assigning dedicated “adversary teams” to model these personas based on validated competitive intelligence, you move from “guessing” to “predicting” the competitive landscape.

The “Goldilocks zone” is typically 4 to 8 months before the final RFP release. If you conduct it too early, the competitive landscape is too vague; if you wait until the RFP is out, it is often too late to make meaningful changes to your teaming strategy or technical solution. Doing a Black Hat right before submission is often just “checking a box” rather than driving a strategy.

It’s not worthless, but it’s late. By final RFP release your teaming is fixed and your technical approach is largely committed, so a Black Hat can only inform ghosting language and proposal emphasis rather than strategy. The high-value window is 4–8 months before release, when you can still change your team, your solution, and your price position.

Assign 2–3 people per competitor team, with each team acting as a miniature capture team for the competitor they’re modeling. Two to three is deliberate: solo assignments produce one person’s guesses with no counterpoint, and large groups lose focus and drift. Teams should include people who know the competitor, the customer, and the technical challenge well enough to simulate a credible bid.

The facilitator is a separate and more demanding role. A Black Hat facilitator must be well versed in structured analytical techniques — experience alone is not the qualification, and neither is the ability to take good notes. The job requires absorbing new information as it surfaces during the session, synthesizing it in real time, and applying it to redirect the analysis. It is a balance of discipline, dynamic thinking, and the judgment to ask the right question quickly in a fast-moving room. A general business facilitator cannot do this.

You need three things in place before the session: confirmation of who the credible competitors actually are, independent research on each one, and a defined set of core questions the session must answer.

The research has to be documented, not remembered. Top-of-mind knowledge from the capture team is almost always incomplete, and GenAI tools return only high-level information — neither is a foundation for simulating how a competitor will bid. FedSavvy produces a Rapid CI™ profile on each named competitor to establish what that competitor can actually do, and runs a Competitor Scan first if the field isn’t yet clear.

The core questions must be derived from what you know about the opportunity and its likely evaluation criteria, and written with the capture team before the session. Questions built from anything else send teams somewhere the evaluation won’t reward.

AI can do part of the work, but not the part that determines whether the review succeeds. GenAI tools are genuinely useful for processing volume and supporting analysis — summarizing documents, organizing findings, surfacing patterns across large sets of material. That’s real value and worth using.

Two things they can’t supply. First, access. Much of the intelligence that drives an effective Black Hat isn’t in a model’s training data or reachable through a search — it comes from collection methods and sources built for the purpose. A model can only reason over what it can see, and for competitor-specific questions that’s usually the public surface.

Second, judgment. Experienced capture, program, and competitive intelligence professionals draw on years of watching what actually wins — which tactics work against which evaluators, how a nuance in Section M changes a scoring outcome, when a competitor’s stated approach won’t survive contact with the customer. That pattern recognition is earned, and it’s what turns competitor information into a predicted bid.

Use AI to accelerate the work. Don’t use it as the source.

A Black Hat Review stays objective when an independent third-party facilitator runs it — someone with no stake in the proposal’s internal politics. To combat “irrational exuberance,” that facilitator enforces a simulation-based approach, treating competitors as well-resourced adversaries rather than pushovers. This “critical distance” ensures that competitor strengths are respected and your own vulnerabilities are exposed before the government finds them.

Databases are basic Garbage In, Garbage Out resources. They operate on basic facts. Black Hat Reviews are structured analytical exercises that demand understanding of a specific competition and how federal contract competition works. Further, you ended competitor profiles that are shaped to fit a specific competition to tailor analysis of a competitor to define who and what they are specific to the unique requirements of a single competition.

Former employees give you biased, outdated, and departmentally narrow intelligence, so they can’t be your only source. Relying on them exclusively leads to “anecdotal intelligence.” A rigorous Black Hat should instead be fueled by Rapid CI—real-time data on contract footprints, unique IP, and recent M&A activity—to build a current and accurate profile of how that competitor operates today, not three years ago. Furthermore, Black Hat teams need to be capture teams of people who know the competitor, the customer and technical challenges so you can properly simulate what a competitor can do to win.

Findings must be converted into actionable “ghosting” points in your technical and management volumes. If the Black Hat reveals a competitor has high personnel turnover, your proposal shouldn’t just say “we have low turnover”—it should highlight your “incumbent-strength retention programs” as a risk-mitigation factor. This forces the evaluator to look at the competitor’s turnover as a documented risk while scoring you higher.

A Black Hat Review must be meaningful to inform solution revisions, capture strategy and price-to-win. This is not just a set of slides. This is a document that answers the fundamental questions to inform next steps for a capture effort to have the best possible chance to win.

A solid Black Hat breakout session runs 3–5 hours. That’s the session itself; total investment scales with the number of competitors you need to work, since each one requires its own team, its own research, and its own exercises.

The session length assumes you’re doing it right. A Black Hat is a problem-solving session, not a slide-filling exercise. If your review consists of teams populating a template and reading it back, it will finish faster and be worth nothing. The 3–5 hours is what it takes to model competitor behavior, challenge assumptions in real time, and reach conclusions the capture team can act on.

Yes, and incumbents often need one more than challengers do. Incumbentitis — the assumption that holding the work means keeping it — is a terminal disease in GovCon, and incumbent teams are unusually prone to it because they operate inside their own echo chamber. Familiarity with the customer gets mistaken for a defensible position.

An outside resource breaks that. FedSavvy challenges the incumbent team’s assumptions about who will actually compete, forces the question of how a challenger could beat them, and roots out the bias built into a team that has been winning this work for years. Two of our case studies are incumbent defenses: a $200M+ U.S. Space Force DevSecOps recompete, and a DHS flagship recompete that doubled the original contract value against an aggressive former incumbent.