Article contents
A pentest looks for as many weaknesses as possible in systems agreed in advance, while a red team tests whether your company would detect and stop a real targeted attack. If you do not yet know where your gaps are, start with a pentest; a red team makes sense once the main findings are fixed and there are people who watch security and respond to alerts.
Below you will find both formats explained in plain words, a comparison table, the conditions for red team readiness and a rule that helps you decide in five minutes.
In short
- A pentest answers "what weaknesses do these systems have and what could an attacker do with them". The scope is narrow and clear, and the team usually knows about the test.
- A red team answers "would a real attack reach an important target, and would anyone notice". The scope is wider: people, processes and technology together, and only a few people know about the test.
- A pentest usually takes a week or more. A red team more often takes several weeks or longer, because it imitates a patient attacker.
- A red team without working monitoring and people who respond to alerts shows only the obvious: "nobody noticed".
- For most companies the right order is: scanning, then a pentest, and a red team later, once there is a security team.
What a pentest means and what a red team means
A pentest (penetration test) means a test in which specialists, within agreed limits, try to get around the protection of specific systems the way an attacker would. NIST describes it exactly so: imitating real attacks to find ways around the security of an application, system or network, often by combining several vulnerabilities. [3]
A red team means a group of people authorised to imitate a potential adversary, in order to show the impact of a successful attack and test what actually works for the defenders. [1] The exercise itself, according to NIST, reflects real conditions and assesses the security of the whole organisation, not one system. [2] In this terminology the defenders are called the blue team (the people who detect attacks and respond).
Put simply: a pentest checks the doors, windows and locks. A red team checks whether the guards notice someone already walking down the corridor towards the safe.
Comparison
| Pentest | Red team | |
|---|---|---|
| Goal | Find as many vulnerabilities as possible in agreed systems | Test whether a real attack is detected and stopped |
| Scope | Specific systems: a website, an API, a mobile app, the perimeter | The company as a whole: people, processes, technology, a path to a defined target |
| Duration | Usually a week or more, depending on scope | Usually several weeks or longer, depending on the targets |
| Who knows | Usually IT and the system owners | Only a small group of managers; the defending team is not warned |
| How it works | Broad: checks as many problems as possible | Narrow and quiet: looks for one working path to the target, like an attacker |
| What you learn | A list of vulnerabilities with priorities and fixes | Where the attack went unnoticed, how long the response took, what did not work |
| Who it suits | Almost any company with its own product or customer data | Companies with working monitoring and people who respond to incidents |
| Result | A findings report and a retest | A report on the attack path, a timeline for the defenders, an improvement plan |
What you learn from each format
After a pentest you have a list of specific problems: for example, a customer can see other people's orders, an admin panel is reachable from the internet, a password can be guessed without limits. Each finding has a description, proof and a recommendation. You fix them and order a second check (a retest).
After a red team you learn something else: whether detection worked once the attacker was already inside, whether the person on duty understood what was happening, how much time passed from the first signal to a response. A red team can miss dozens of small vulnerabilities, because one working road to the target is enough for it. That is why it does not replace a pentest.
MITRE ATT&CK, an open knowledge base of attacker tactics and techniques built from observations of real attacks, is a handy way to describe what attackers do. [4] A red team report often shows which of these techniques your defences noticed and which they did not.
When a company is ready for a red team
A red team is useful only when there is something to test. Signs of readiness:
- critical and high findings from the last pentest are fixed and confirmed by a retest;
- event logs (records of logins, programs started, network connections) are collected in one place;
- someone actually reviews alerts: your own team, an administrator on duty or an external monitoring service;
- there is an incident response plan and people know whom to call;
- management is ready to hear an unpleasant result and to fund the fixes;
- there is a person who can run the test from the inside and stop it if something goes wrong.
If most of these points are not about you yet, a red team will show only one thing: nobody noticed the attack. That money is better spent on a pentest and on setting up monitoring.
How financial institutions in Europe run red teams
The European Central Bank describes the TIBER-EU framework for threat intelligence based ethical red teaming. [5] The test imitates the tactics and techniques of real attackers, chosen specifically for the institution, and targets its critical functions.
A few useful ideas from this framework worth borrowing even without a regulator:
- The result is not "pass or fail". The aim is to see the strengths and weaknesses of your defences and learn from them.
- Only the control team knows about the test, a small group inside the company. The defending team works as on any normal day.
- The scenario is built on threat intelligence: who could really attack you and how.
- After the test a remediation plan is written, rather than putting the report in a drawer.
The framework was designed for entities that provide core financial infrastructure, but according to the ECB it can be used in all critical sectors. It also helps meet the DORA requirements for threat led penetration testing. [5]
Decision rule
Choose a pentest if:
- your systems have never been tested by hand, or the last test was long ago;
- you are preparing a product launch, a big update or a new integration;
- a partner, customer or regulator asks for a test report on a specific system;
- nobody in the company watches security alerts.
Choose a red team if:
- you already run pentests regularly and the findings are fixed;
- you have monitoring and people who respond to incidents, and you want to test exactly them;
- management asks "would we notice an attack", not "do we have vulnerabilities".
If you are not sure even about a pentest, start with the article pentest or vulnerability scan: it explains the first step.
Common mistakes
- Ordering a red team instead of the first pentest. You get an expensive report saying the attack went unnoticed and learn very little about what exactly to fix.
- Warning the whole team. Then you test not the response, but how alert people are on a day they expect an attack.
- Not defining targets. A red team needs a clear target: access to the payment system, the customer database or the CEO's mailbox. Without one, the result is hard to judge.
- Not agreeing the rules in writing. Scope, forbidden actions, a contact person and a way to stop the test are fixed before work starts.
Checklist: are you ready for a red team
Download the preparation checklist (PDF)PDF · A4
FAQ
What is the difference between a red team and a pentest in simple terms?
A pentest looks for as many weaknesses as possible in specific systems. A red team tests whether your company would notice and stop a real attack on an important target, and it uses one quiet path for that, not every possible one.
Can a red team replace a pentest?
No. A red team looks for one working path to the target and does not try to find all vulnerabilities. You still need a pentest to check specific systems, especially after changes.
How long does a red team engagement take?
It depends on the targets and scope. Usually it is several weeks of active work plus preparation and the report, noticeably longer than a typical pentest.
Will our employees know about the red team?
Usually only a small control group knows: it runs the test and can stop it. The rest of the team works as usual, otherwise the response cannot be tested.
Does a small company need a red team?
Most often not, at least not as a first step. A small company gains more from a pentest of key systems and setting up monitoring. A red team makes sense once there are people who respond to alerts.
References
- NIST CSRC Glossary: Red Team csrc.nist.gov
- NIST CSRC Glossary: Red Team Exercise csrc.nist.gov
- NIST CSRC Glossary: Penetration Testing csrc.nist.gov
- MITRE ATT&CK attack.mitre.org
- ECB: What is TIBER-EU? ecb.europa.eu
