Penetration testing and red teaming are often used as if they mean the same thing. They don't. Both involve authorised attackers, but they answer different questions, and buying the wrong one wastes budget.
Penetration test: how many holes are there?
A penetration test aims to find as many vulnerabilities as possible in a defined scope, such as a web app, an API, a network range or a cloud account, within a fixed time. Testers work openly: your team knows the test is happening, and the goal is coverage.
- Question it answers: what weaknesses exist in this system, and how serious are they?
- Typical length: one to three weeks
- Output: a list of findings ranked by severity, with fixes
- Best for: new releases, compliance requirements, customer security questionnaires, regular assurance
Red team: could a real attacker reach what matters?
A red team engagement simulates a real adversary pursuing a specific goal, like reaching customer data, a payment system or an executive's mailbox. It uses whatever an attacker would: phishing, exposed services, weak credentials, physical access if agreed. Usually only a few people in your organisation know it's happening.
- Question it answers: can your people, processes and tools detect and stop a determined attacker?
- Typical length: four to twelve weeks
- Output: an attack narrative, the detection gaps, and an improvement roadmap
- Best for: organisations that already test regularly and have a security team or SOC to evaluate
How to choose
| If you… | Start with |
|---|---|
| Have never had a security test | Penetration test |
| Need evidence for ISO 27001, SOC 2 or a client | Penetration test |
| Fix pentest findings regularly and want the next level | Red team |
| Have invested in monitoring and want to know if it works | Red team |
A common mistake: commissioning a red team before basic vulnerabilities are fixed. The red team will simply walk in through them, and you'll pay a premium to learn what a penetration test would have told you.
The middle ground
Assumed-breach testing starts from the position of an attacker who already has a foothold, such as a compromised employee laptop or account, and measures how far they can get. It's faster and cheaper than a full red team, and very good at revealing internal weaknesses.
Not sure which fits? Request a demo and we'll walk you through both, or ask for a red team quote.