"Red team" has become a buzzword, and many vendors use it to describe what is really a standard penetration test. The two are different services with different goals, prices and prerequisites. Buying a red team engagement before your organisation is ready is one of the most expensive mistakes in security testing. This guide explains the difference and helps you decide what you need now.
The one-sentence difference
A penetration test tries to find as many exploitable vulnerabilities as possible in a defined scope. A red team engagement tries to achieve a specific objective — like reaching customer payment data — while staying undetected, to test how well your people, processes and technology detect and respond.
Side-by-side comparison
| Penetration test | Red team | |
|---|---|---|
| Goal | Find and prove vulnerabilities | Achieve an objective; test detection and response |
| Scope | Defined assets (app, network, cloud) | The whole organisation — people, process, technology |
| Stealth | Not required; defenders usually know | Essential; only a small "white team" knows |
| Breadth vs. depth | Broad coverage of the scope | One or a few realistic attack paths, executed end to end |
| Techniques | Technical exploitation | Phishing, physical, technical, evasion, persistence |
| Duration | 1–3 weeks | 4–12+ weeks |
| Output | List of findings with fixes | Attack narrative, detection gaps, response timeline |
| Typical cost | $4,000 – $30,000 per scope | $30,000 – $150,000+ |
Are you ready for a red team?
Red teaming measures your defenders. If you don't yet have defenders — or they can't see what's happening — the red team will simply walk in, and you'll pay a premium to learn what a cheaper penetration test would have told you. A useful readiness check:
- You run regular penetration tests and fix what they find
- You have centralised logging and a SIEM or XDR platform
- Someone — an internal SOC or a managed provider — monitors alerts 24/7
- You have an incident response plan that has been exercised at least once
- Endpoint detection (EDR) is deployed across most of your estate
If you tick fewer than three of these, start with penetration testing and detection engineering. If you tick all five, a red team will give you insights nothing else can.
Purple teaming: the middle ground
A purple team exercise puts attackers and defenders in the same room. The offensive team executes specific techniques — often mapped to MITRE ATT&CK — one at a time, and the defensive team checks whether each was logged, alerted on and responded to. It is collaborative, educational and excellent value for organisations building a SOC, because every gap found is immediately turned into a detection improvement.
What a red team engagement looks like
- Objectives and rules of engagementAgree "crown jewel" objectives, legal authorisation, off-limits actions and a white-team escalation path.
- Threat intelligence and reconnaissanceModel realistic adversaries for your sector and map people, technologies and exposures.
- Initial accessPhishing, exposed services, physical intrusion or supply-chain angles — whatever a real adversary would try.
- Persistence, escalation and lateral movementQuietly expand access towards the objective while evading detection.
- Objective and reportingDocument the full attack path, what was and wasn't detected, and how long response took.
Frameworks you may hear about
- MITRE ATT&CK — the common language for adversary tactics and techniques.
- TIBER-EU and the UK's CBEST — intelligence-led red teaming frameworks for financial institutions.
- DORA threat-led penetration testing (TLPT) — required for certain significant financial entities in the EU under the Digital Operational Resilience Act.
How to choose a red team provider
Look for a provider with demonstrated offensive research, experience evading modern EDR, mature operational security (they will hold sensitive access to your environment), and a strong reporting practice that translates the attack into concrete detection improvements. Learn how we run red team and purple team engagements.
Frequently asked questions
Is a red team better than a pentest?
Neither is better — they answer different questions. Pentests find vulnerabilities in a scope; red teams test detection and response against a realistic adversary.
How long does a red team engagement take?
Typically 4–12 weeks, including planning, reconnaissance, execution and reporting.
Will a red team disrupt our business?
A professional red team operates under strict rules of engagement with a white team able to pause activity, and avoids destructive actions.
Not sure which you need? Talk to a senior tester — we'll tell you honestly if a pentest is the better first step.