Pentest basics
Red team vs penetration testing: what is the difference?
Red team vs pentest: how the two differ in goal, scope, stealth and who knows, with an 11-row comparison table and a decision table for choosing one.
Short answer
A penetration test looks for as many weaknesses as possible in a defined scope, with the defenders usually aware. A red team exercise pursues an objective, such as reaching a set of data, while testing how well the organization detects and responds. Most teams need pentests first. Red teams suit organizations with working detection.
A penetration test finds weaknesses in a defined scope. A red team exercise tests whether the whole organization can detect and stop an attacker who pursues a goal. Both are authorized, and they differ in aim, scope, stealth and output.
The NIST glossary, citing CNSSI 4009-2022, defines a red team as "a group of people authorized and organized to emulate a potential adversary's attack or exploitation capabilities". It adds that the aim is to strengthen security by showing the effects of successful attacks and showing defenders which measures work in a live setting. That job is wider than a pentest.
What is the main difference?#
A pentest asks: which weaknesses exist here, and how bad are they? A red team exercise asks: can an attacker reach this goal, and will we notice and respond?
A pentester wants breadth and tries to find and prove many flaws in the scope. A red team wants one path to a goal, picks the quietest route and may leave other flaws alone.
How do they compare?#
| Penetration test | Red team exercise | |
|---|---|---|
| Main question | What weaknesses exist and what do they allow? | Can an attacker reach an objective, and do we detect and respond? |
| Goal | Many findings, proven | One or a few objectives (for example, reach a data set) |
| Scope | Defined systems: an app, an API, a network | Broad: systems, people, process, sometimes physical sites |
| Stealth | Not needed. Defenders often know. | Central. The team tries to avoid detection. |
| Who knows | Security and engineering, usually | A small group, often only senior staff |
| Duration | Short, fixed window | Longer, often weeks |
| Methods | Technical testing within the rules | Any approved route, such as phishing, stolen credentials, chained flaws |
| Output | Findings list with fixes | Attack story, detection gaps, response timeline, plus fixes |
| Success measure | Coverage and quality of findings | Objective reached or stopped, time to detect, time to respond |
| Best when | You need to find and fix weaknesses | Your controls and team are in place and you want to test them |
| Cost and effort | Lower | Higher |
What does a pentest give you that a red team does not?#
A pentest gives breadth and a fix list. The tester reports every flaw found in scope, with evidence and fix guidance, which is what a software team needs before a launch or a customer review.
A red team may report only the path it used and skip other flaws if the path was easy. You get one sharp story, not a full list.
What does a red team give you that a pentest does not?#
A red team tests your detection and response: whether alerts fire, whether staff notice, and how fast the team acts. A pentest usually does not test this, because defenders know about it.
A red team can also cross boundaries, from a phishing email to a cloud account to a database. A pentest of one app does not follow that chain.
Which one do you need? A decision table#
| Your situation | Choose |
|---|---|
| First test, no recent report | Pentest |
| Customer or auditor asks for a pentest report | Pentest |
| Launching a new app or API | Pentest. See pre-launch testing |
| You fixed pentest findings and have security monitoring | Consider a red team |
| You want to test your security operations team | Red team, or a purple team exercise |
| You have no alerting or incident process | Build that first. Then red team |
| You want to test staff against phishing | Scoped social engineering test or a red team |
| You ship AI features, agents or LLM apps | See the AI red teaming guide, below |
A company can use both over time: a pentest each year and after major changes, and a red team once its defense is mature.
What about purple teams?#
A purple team is a joint exercise. Attackers run techniques, defenders watch in real time, and both tune detection together. It teaches faster than a blind red team but does not test surprise.
Does red teaming apply to AI systems?#
The word "red team" is also used for testing AI models and applications. That work tests prompt injection, data leaks through retrieval and unsafe agent actions, and it differs from the classic exercise described here.
For AI systems, read AI red teaming vs penetration testing on airedteamingservices.com. If your product has an AI feature, our AI application security page explains why it needs a different test.
What rules do both need?#
Both need written authorization and clear limits. A red team needs stricter rules because the test is broad and stealthy. Define the objective, the off-limits actions, the stop conditions and who knows, and name a small group that can call the exercise off. See rules of engagement.
A short example#
Demonstration only
This is a demonstration. No real customer system was tested. Harbor Notes is a fictional SaaS app. It has done two yearly pentests and fixed the findings. It now runs a small security team that watches alerts.
The company wants to know whether an attacker could reach customer note data without being noticed. A pentest of the app would find flaws, but the defenders would know the test was running. So the company agrees a red team objective: "Reach the notes database from an outside position." Only three managers know, and the exercise runs under written rules. The result is a timeline: the attackers got a foothold through a phished test account, the alert fired after some hours, and the response had gaps. The report lists the fixes for each gap.
To plan the next step, read how often should you pentest. Our services page lists what we test.
Need a pentest you can act on?
Tell us what you need tested and why. We reply to agree scope, and testing starts only after written authorization.
Questions
Is a red team better than a pentest?
No. They answer different questions. A pentest finds many weaknesses and gives a fix list. A red team tests whether your people and tools notice and stop an attack. Without basic fixes in place, a red team will find easy paths.
What is a purple team?
A purple team exercise has attackers and defenders work together. The attacker runs a technique, and the defender checks whether it was seen and how to improve detection. It is more of a shared training and tuning exercise than a contest.
Does Excession Labs offer red team exercises?
Our focus is web app, API and SaaS penetration testing. The comparison above should help you choose. We do not list full red team exercises as a service on this site.
Do small companies need a red team?
Usually not yet. If you lack security monitoring or an incident process, a red team shows only that. Start with a pentest and fix the findings. Consider a red team when you have a team that watches alerts.
Sources
- NIST CSRC Glossary: red team (CNSSI 4009-2022) (checked 9 November 2026)
- NIST SP 800-115: Technical Guide to Information Security Testing and Assessment (checked 9 November 2026)
- PTES Pre-engagement (Internet Archive capture, 2025-01-03) (checked 9 November 2026)