A penetration test aims to find as many exploitable vulnerabilities as possible within a defined scope, in a fixed window, with defenders fully aware. A red team engagement simulates a real adversary pursuing a specific objective — quietly, over weeks, against your people and processes as well as your technology. They answer different questions, and buying the wrong one wastes money.
What a penetration test is
A penetration test is a time-boxed, scoped assessment of a specific target: a web application, an API, an external network range, a cloud environment. The testers work methodically through that scope trying to find and demonstrate every meaningful vulnerability, then hand you a report with risk-rated findings and remediation advice.
Key characteristics:
- Goal: breadth. Find as many issues as possible in the allotted time.
- Scope: defined and agreed up front. Specific systems, applications or ranges.
- Duration: typically one to two weeks per target.
- Visibility: overt. Your IT and security teams know it is happening; testing is often allowlisted through the WAF so time is spent finding real flaws rather than fighting rate limits.
- Output: a detailed findings report you can hand to engineers, auditors and customers.
This is what compliance frameworks (SOC 2, ISO 27001, PCI DSS) and enterprise security questionnaires are asking about when they require testing.
What a red team engagement is
A red team engagement starts from an objective, not a scope: access the customer database, reach the payment system, obtain domain administrator. The team is free to use any realistic path to get there — phishing and other social engineering, external exploitation, credential attacks, sometimes physical entry — while actively evading detection.
Key characteristics:
- Goal: depth. One convincing path to the objective, not a catalogue of every flaw.
- Scope: broad, with agreed rules of engagement rather than a target list.
- Duration: several weeks to months, because realistic attacks are slow and stealthy.
- Visibility: covert. Only a small trusted group knows. The point is to test whether your monitoring and response actually detect and stop an intruder.
- Output: an attack narrative — the path taken, what was detected and when, where response broke down — plus recommendations for both prevention and detection.
A red team tests the whole organisation: technology, people and process together.
The differences at a glance
- Question answered. Pentest: what vulnerabilities exist in this system? Red team: can an adversary reach our crown jewels, and would we notice?
- Coverage. Pentest: thorough within scope. Red team: narrow but realistic path across the organisation.
- Stealth. Pentest: none needed. Red team: essential.
- Who is tested. Pentest: the system. Red team: also your SOC, your staff and your incident response.
- Cost. A scoped pentest is days of effort; a red team is weeks to months and priced accordingly — usually several times the cost.
Which should you buy?
Buy a penetration test if:
- You have never had formal security testing, or your last test is over a year old.
- You need evidence for compliance, an auditor or an enterprise customer.
- You are shipping or significantly changing an application, API or environment.
- You do not yet have mature detection and response capability.
Buy a red team engagement if:
- You already test regularly and remediate the findings.
- You have invested in detection — a SOC, an MDR provider, EDR and centralised logging — and want to know whether it works under real pressure.
- You want to exercise your incident response process against a live, thinking adversary.
The honest sequencing matters: a red team against an organisation with no detection capability proves nothing you did not already know, and an organisation full of unpatched, untested systems will be breached by a red team in ways a fraction of the budget would have found first. Test, fix, build detection, then red team.
The middle ground is assumed breach testing: you grant the testers an initial foothold (a workstation, a set of standard user credentials) and they attempt to escalate and reach objectives from there. It delivers much of a red team's value in far less time, because nobody spends weeks on initial access.
FAQ
Can a red team engagement replace our annual penetration test?
No. A red team deliberately stops enumerating once it finds a working path, so it leaves most vulnerabilities undocumented. Auditors and customers asking for a penetration test want systematic coverage of a defined scope, which is exactly what a pentest provides.
How long does each take?
A typical penetration test runs one to two weeks per target. Red team engagements usually run four to twelve weeks, including reconnaissance, initial access attempts and slow, quiet lateral movement designed to test your detection.
What is a purple team exercise?
A collaborative version: attackers execute techniques while your defenders watch, tune detections and re-test in real time. It is less realistic than a covert red team but transfers more knowledge to your blue team per dollar, and is often the right step between regular pentesting and a full red team.
Not sure which fits where you are right now? Contact us for a free scoping call — we will tell you plainly if we think you are not ready for a red team yet, and quote the option that will actually move your security forward.
Need cybersecurity expertise?
Drop your email and we'll be in touch within one business day.