A pentest and a Red Team engagement are both offensive security exercises, but they answer different questions. A pentest finds and proves as many exploitable vulnerabilities as possible within a defined scope and time frame. A Red Team simulates a real, persistent adversary pursuing a specific objective, without warning the defense team, in order to test not only the technology but also the people and the detection and response processes of the organization. In short, a pentest measures how vulnerable you are, and a Red Team measures how well you would detect and respond to a real attack.
This article explains what separates the two, when each one is the right choice, and how they fit together as an organization’s security maturity grows. If you are still deciding on your first offensive test, start with the foundational guide on what a pentest is and then return here to choose the right exercise.
The short answer
If you need to find and fix vulnerabilities across a set of systems, run a pentest. If you already have a security team and want to know whether they would catch a real attacker, run a Red Team. A pentest is about breadth of vulnerabilities. A Red Team is about depth toward a goal and the quality of your detection.
Most organizations are not ready for a Red Team on day one. A Red Team only produces value when there is a defense capability to test. Sending a Red Team against an organization with no monitoring is like testing a fire alarm in a building that has none. You already know the answer.
What a pentest is
A pentest (penetration test) is an authorized, scoped assessment in which specialists exploit vulnerabilities to prove they are real and to measure their impact. It follows formal methodologies such as PTES, OWASP, and NIST SP 800-115, and it typically covers a defined set of targets: an application, an external perimeter, an internal network. The defense team usually knows the test is happening, because the goal is coverage and evidence, not stealth.
The deliverable is a report that lists each finding with proof of exploitation, a severity rating, and a prioritized remediation path. The full breakdown of types, phases, and pricing lives in the complete pentest guide.
What a Red Team engagement is
A Red Team engagement is an objective-based simulation of a real adversary, run over a longer period, using the full attack chain that a genuine threat actor would use. Instead of listing every vulnerability, the Red Team picks a goal that matters to the business, for example reaching a specific database, obtaining domain administrator access, or exfiltrating a sample of sensitive data, and works toward it by any realistic means.
That means the Red Team blends techniques that a standard pentest usually leaves out: stealth and evasion to avoid the EDR and the SOC, social engineering and phishing against employees, and sometimes physical access attempts. Engagements are mapped to real adversary behavior using the MITRE ATT&CK framework, and the most advanced ones are threat-led, meaning the scenario is built from intelligence about the actual threat actors that target the organization’s sector. Regulated frameworks such as TIBER-EU and CBEST formalize this threat-led approach for the financial sector.
Crucially, the defense team (the blue team) is not warned. The point is to measure real detection and response, not to test technology in a vacuum.
Pentest vs Red Team: the key differences
The two exercises differ across almost every dimension: their objective, scope, duration, and even who inside the organization knows they are happening.
Dimension
Pentest
Red Team
The single most important line in this table is maturity required. It is the factor that decides which exercise will actually give you a return.
When to use a pentest
Choose a pentest when the goal is to find, prove, and fix vulnerabilities across specific systems. It is the right exercise in the following situations:
- You are launching or heavily updating an application and need to validate it before it goes live.
- A contract, audit, or regulation (PCI-DSS, ISO 27001) requires evidence of regular testing.
- You migrated to the cloud or changed network architecture and need to confirm the new exposure.
- You are building your security program and need a baseline of your technical risk.
- You want broad coverage of a perimeter or an application within a predictable budget and timeline.
For most companies, a pentest is the correct starting point and the recurring exercise that keeps technical risk under control.
When to use a Red Team
Choose a Red Team when the goal is to test whether your organization can detect and respond to a real attack. It makes sense when:
- You already run a SOC or have monitoring, EDR, and an incident response process to test.
- Your pentests have matured and consistently return few critical findings, so you need a harder question answered.
- Leadership wants to know the real-world resilience of the organization, not just a vulnerability count.
- You operate in a high-value sector (financial, critical infrastructure) where realistic adversary simulation is expected or regulated.
- You want to train and measure the blue team under realistic pressure.
If your monitoring is not yet in place, the budget for a Red Team is better spent first on a pentest and on building detection. The Red Team then measures how well that investment works.
Do you need both? Where purple teaming fits
For a mature security program, the answer is usually both, in sequence and on different cadences. Pentests run regularly to keep technical vulnerabilities under control, while a Red Team engagement runs less frequently to validate detection and response as a whole.
There is also a third mode worth knowing: the purple team. In a purple team exercise, the offensive team (red) and the defensive team (blue) work together in real time, with the red team executing techniques while the blue team watches, tunes detection, and closes gaps on the spot. It is the fastest way to turn a Red Team’s findings into improved defenses, and it is often the natural next step after a first Red Team engagement reveals detection gaps.
A healthy progression for most organizations looks like this: start with pentests to build a baseline, add continuous vulnerability management, introduce a Red Team once monitoring exists, and use purple teaming to sharpen detection based on what the Red Team finds.
Do you need both? Where purple teaming fits
Mercurius operates both exercises with a real offensive mindset, run by certified engineers (OSCP, CRTO, among other credentials) who think like the attacker in order to protect like a strategist. On the pentest side, the focus is proving exploitable risk with depth and delivering a report the board can act on. On the Red Team side, engagements are threat-led and mapped to MITRE ATT&CK, using custom tooling and command and control infrastructure to emulate the adversaries that actually target the client’s sector.
The guiding principle is to recommend the exercise that fits the organization’s maturity, never to sell a Red Team to a company that first needs a pentest. Learn about the pentest and offensive security service and the Red Team service, and if you are unsure which one fits your stage, that conversation is the right place to start.
See your network the way an attacker does — before one does!
Mercurius runs manual-led Red Team, penetration testing and cloud assessments that don’t just list vulnerabilities — they prove the exact path an adversary would take to your crown jewels, and how to close it.
Learn about the pentest and offensive security service from Mercurius
Frequently asked questions
Is a Red Team just a more advanced pentest? No. They answer different questions. A pentest measures how many exploitable vulnerabilities exist in a defined scope. A Red Team measures whether your organization would detect and respond to a real attacker pursuing a goal. One is about breadth of vulnerabilities, the other about depth and detection.
Which one should my company start with? Almost always a pentest. A Red Team only produces value when there is a detection and response capability to test. If you do not yet have monitoring or a SOC, invest first in a pentest and in building detection, then bring in a Red Team to validate it.
Does the defense team know a Red Team is happening? No. The whole point of a Red Team is to measure real detection and response, so the blue team is not warned. Only a small group of sponsors inside the organization knows, to keep the exercise safe and authorized. In a pentest, by contrast, the defense team is usually aware.
How long does each exercise take? A pentest typically runs from a few days to a few weeks, depending on scope. A Red Team engagement runs longer, usually several weeks to a few months, because stealth, reconnaissance, and working toward an objective all take time.
What is a purple team? A purple team exercise has the offensive team and the defensive team working together in real time, so detection gaps are found and fixed on the spot. It is the fastest way to convert a Red Team’s findings into stronger defenses, and it often follows a first Red Team engagement.
Can one provider do both? Yes, and there is an advantage to it. A provider that runs your pentests understands your environment, which makes a later Red Team more realistic and efficient. The key is that the provider recommends the exercise that fits your maturity rather than defaulting to the most expensive one.
