Red team assessment or penetration test: which one does your company need?
Anyone who wants their security tested from the outside soon comes across two terms: penetration test and red team assessment. Both use real attack techniques, and both end with a report. Still, they answer different questions. Order the wrong one and you get a good answer to a question you never asked.
Two questions, two methods
A penetration test asks: what vulnerabilities does this system have, and how far can you get through them? It works through an agreed scope as completely as possible, such as a web application or a network segment.
A red team assessment asks: does an attacker reach a specific goal, and does anyone notice? The goal is set in advance, for example the design data or the control system of a plant. The route there is open and runs through technology, people and buildings. The security team does not know an exercise is under way.
The comparison at a glance
- Goal: the penetration test looks for as many vulnerabilities as possible within a fixed scope. The red team tries to reach a single agreed goal.
- Scope: individual systems or applications for the penetration test, the whole company including staff and buildings for the red team.
- Duration: for a web application a penetration test usually takes three to five days, for a mid-sized infrastructure one to two weeks. A red team assessment runs for six to eight weeks.
- Who knows: in a penetration test IT is often informed, depending on the goal. In a red team assessment three to five people are in the loop, and the security team is not one of them.
- Method: the penetration test follows a test plan for the agreed scope. The red team acts like a real attacker, mapped to MITRE ATT&CK and to TIBER-EU where required.
- Result: the penetration test delivers findings by severity and a retest after remediation. The red team delivers the attack path, the gaps in detection, new detection rules and a short summary for management.
Three typical situations
A new customer platform is due to go live in six weeks. The question is whether the application has gaps an attacker could exploit. That is a clear case for a penetration test of the web application, with a retest before launch.
A machinery manufacturer has hired a SOC service and introduced central logging. Management wants to know whether this works in an emergency. A penetration test is of little help here, because it does not test detection. A red team assessment with the design data as its goal answers exactly this question.
An insurer is one of the financial entities that must carry out threat-led penetration tests under DORA. TIBER-EU describes the framework for this, and that framework is a red team assessment.
When a red team comes too early
A red team assessment assumes there is a defence that can notice something: central logging, someone who looks, and defined escalation paths. Without these, the exercise only confirms what you already suspect. If a simple vulnerability scan still finds open admin interfaces, it is time to clean up first and then run a penetration test.
One-off or ongoing
Both tests are snapshots. If you want to know regularly where you stand, you can combine them. Red Teaming as a Service brings monthly attack simulations, quarterly penetration tests and training together in one subscription.
Not sure which test suits you? In a first conversation we clarify goal and scope. Quite often it ends with the advice to do something else first.
Blog
More articles
Implementing NIS2: from gap assessment to action plan
Five steps from the question of whether NIS2 applies to you to a plan that management and IT can work through together. Checkli…
neonotu at CES 2027 in Las Vegas
From January 6 to 9, 2027, we show Sightadel, veyrisk and Valar at booth 50123 in the Venetian Expo, with live demos and short …
Why continuous vulnerability management now belongs in every business
New vulnerabilities are published every week, and attackers look for systems that have not been updated yet. Why one scan a yea…
Contact
Reputation takes years. Destruction takes seconds.
Talk to us before somebody else does. The first conversation is free and we reply the same business day.