Red team vs pentest: what's the difference, and which should you choose?

Both terms come up frequently in security discussions, sometimes used interchangeably. They shouldn't be. A pentest and a red team engagement answer different questions, use different methods, and target different maturity levels. Knowing which fits your situation will save you from paying for the wrong exercise.

What a pentest is

A pentest (penetration test) is a targeted exercise whose objective is to find as many vulnerabilities as possible on a defined scope. The scope is known in advance: a web application, an API, a network infrastructure, a mobile application. The tester looks for exploitable flaws, documents them with evidence, and delivers a report with remediation recommendations.

A pentest doesn't concern itself with whether your security team detected it. The objective is surface coverage, not simulating a realistic end-to-end attack scenario. It can be conducted black box, grey box, or white box depending on the information provided.

What a red team engagement is

A red team engagement is a realistic end-to-end attack simulation, modelled on the behaviour of a real adversary. The red team (the attackers) aims to reach a specific objective (access sensitive data, take control of a critical server, demonstrate exfiltration) using all available vectors: logical (technical vulnerabilities), physical (premises intrusion, badges, USB), and human (spear phishing, vishing, pretexting).

The blue team (your operational security team, SOC or MSSP) is generally not informed of the engagement. The exercise tests not only technical vulnerabilities, but also your ability to detect an attack and respond to it. Success is measured in detection time, response quality, and depth of penetration achieved.

The key differences

• Objective: A pentest finds vulnerabilities. A red team tests detection and incident response.
• Scope: A pentest has a bounded technical scope. A red team has a target objective, not a fixed perimeter.
• Vectors: A pentest is primarily technical. A red team integrates technical, physical, and human vectors.
• Duration: A pentest lasts 1 to 5 days. A red team typically lasts from 2 weeks to several months.
• Blue team: A pentest doesn't involve the blue team. A red team tests it directly.
• Required maturity: A pentest suits even a first engagement. A red team requires an established security baseline for the results to be meaningful.

Which to choose based on your maturity

If this is your organisation's first serious security exercise, start with a pentest. A red team only delivers value if you already have defences to test. Running a red team before fixing baseline vulnerabilities is like measuring fire detection in a house with no alarm.

A pentest delivers value from maturity level 1. A red team starts making sense from level 3: defences in place, a SOC or active monitoring, a baseline of applied patches. Below that threshold, a red team is expensive and its outcome is predictable.

Running a red team without having done a pentest first is like renovating the kitchen before fixing the roof.

What about purple team?

A purple team exercise is a collaborative variant: the red team and blue team work together, with mutual visibility. The goal is no longer to test whether the blue team detects blind, but to jointly improve detection and response capabilities. This suits organisations with a mature SOC that want to optimise rather than evaluate it.

In practice, MITRE ATT&CK adversary simulation follows this logic: the TTPs (Tactics, Techniques, Procedures) of a real APT group are emulated, and the blue team measures its detection coverage technique by technique.