← All articles

// offensive · guide

Red Team vs Penetration Test: What's the Difference?

These terms get used interchangeably by people selling both. They are not the same thing, and buying the wrong one wastes money.

Aspect	Penetration Test	Red Team
Goal	Investigate agreed assets, controls and attack paths	Exercise agreed adversary objectives and detection
Scope	Defined assets and rules of engagement	Explicitly authorised paths and exclusions
Approach	Depth selected for the objective	Scenario-based adversary emulation
Tests your…	Code & configuration	People, process & detection
Timing	Estimated after scope	Estimated after scope
Best when…	You need a fix list	Your basics are already solid

Penetration test: investigate scoped technical risk

A penetration test investigates agreed assets and attack paths to identify and validate weaknesses. It provides a prioritised remediation record and explicit coverage limits. It is a point-in-time assessment, not proof that every vulnerability was found.

Red team: achieve an objective like a real attacker

A red team engagement exercises agreed adversary objectives and the organisation's ability to detect and respond. Social engineering, physical activity and third-party systems are excluded unless separately authorised in writing. Objectives use controlled test data and explicit stop conditions; the engagement never permits any path without limits.

Which do you need?

• Never tested before? Start with penetration testing. Red-teaming a system full of known holes just proves the holes.
• Mature security, want to test detection? Red team — it stresses your people and monitoring, not just your code.
• Compliance-driven? Confirm the exact testing and evidence requirement with the relevant customer, assessor or auditor. Neither label alone establishes that a requirement is met.

Choose the exercise around the decision you need to make and the team's ability to act on findings. Clear authorisation, safety controls, escalation and remediation matter for both.