A penetration test identifies vulnerabilities in a specific scope—your web app, network, or API—within a defined timeframe, typically 1-4 weeks. A red team exercise simulates a real-world adversary over weeks or months, testing your entire security program including detection, response, and people. Most businesses need penetration testing first; red teaming makes sense once you have mature defenses and want to test them against realistic attack scenarios.
The decision hinges on three factors: your current security maturity, your compliance obligations, and what you're actually trying to learn. Today's threat landscape—with Chinese state actors deploying AI-powered penetration testing frameworks like ARTEX and attackers chaining three Ivanti flaws for unauthenticated root access—demands that organizations understand their attack surface. But choosing the wrong assessment wastes budget and leaves gaps.
What a penetration test actually does
A penetration test is a time-boxed, scope-limited engagement where security professionals attempt to exploit vulnerabilities in your systems. You define the target: external web applications, internal network, cloud infrastructure, or APIs. The testers use manual techniques and tools to find and exploit weaknesses, then deliver a report with findings, risk ratings, and remediation guidance.
Typical pen test scopes:
- External network: Internet-facing assets, no inside access
- Internal network: Assumes an attacker gained initial access (or tester starts from inside)
- Web application: Single app or portal, authenticated and unauthenticated testing
- API security: REST/GraphQL endpoints, authentication bypass, injection flaws
- Cloud configuration review: AWS/Azure/GCP misconfigurations, IAM issues
Timeline: 1-4 weeks depending on scope complexity. Cost: $8,000-$35,000 for most SMB engagements, higher for large or complex environments.
Pen tests satisfy most compliance requirements. PCI DSS 4.0 requires annual penetration testing and after significant changes (section 11.4.3-11.4.6). NYDFS Part 500 mandates annual pen testing for covered entities. SOC 2 auditors expect regular pen tests as evidence of security monitoring. ISO 27001 doesn't prescribe pen testing explicitly but it's a common control under A.12.6.1 (technical vulnerability management).
The maximum-severity GitLab vulnerability now exploited in the wild (CVE-2026-97229, added to CISA's KEV catalog October 29) is exactly what a pen test would catch if GitLab is in scope—before real attackers do. CISA added it alongside two Ivanti Connect Secure flaws (CVE-2026-111357, CVE-2026-118527) that attackers are chaining for root access. A good pen test identifies these exposures when patches are available but not yet applied.
What a red team exercise actually does
Red teaming simulates a real adversary—often a nation-state or sophisticated criminal group—attempting to achieve specific objectives against your organization. The red team uses any technique necessary: phishing your employees, exploiting unpatched systems, physical intrusion, social engineering, supply chain compromise. The goal isn't just to find vulnerabilities; it's to test whether your security operations center (SOC), incident response team, and employees detect and stop the attack.
Red team objectives might include:
- Exfiltrate sensitive customer data from the production database
- Gain domain administrator access in the corporate network
- Deploy ransomware and see if backups can be compromised
- Physically access the data center
- Compromise the CEO's email without triggering alerts
Timeline: 4-12 weeks, sometimes longer. Cost: $35,000-$150,000+ depending on objectives and organizational size.
Red teams operate covertly. Your SOC and IT staff typically don't know it's happening (though executive leadership and legal do). The purple team variant has the red team and blue team (defenders) collaborate in real-time, turning the exercise into a learning opportunity.
The recent WordPress RCE flaw that drew 63,000 attack attempts in 24 hours illustrates what red teams simulate: attackers moving fast on fresh vulnerabilities. A red team would exploit that flaw (if in scope) and see whether your web application firewall, intrusion detection, or SOC analysts catch it before damage occurs.
How to decide which one you need
Choose penetration testing if:
- You've never had a professional security assessment
- You need to satisfy compliance requirements (PCI DSS, NYDFS, SOC 2, HIPAA)
- You want to find and fix vulnerabilities in specific systems
- Your security team is still building foundational capabilities
- Your budget is under $40,000 for the engagement
Choose red team exercises if:
- You've already done multiple pen tests and remediated major issues
- You have a SOC or managed detection and response (MDR) service you want to test
- You want to validate your incident response plan under realistic conditions
- You need to demonstrate security effectiveness to board or regulators
- You're in a high-risk industry (finance, defense, critical infrastructure) facing advanced threats
Most organizations should start with penetration testing and graduate to red teaming. If you don't know your attack surface or haven't patched the critical Linux kernel flaw allowing remote root on MPTCP servers or the Drupal Commerce Core vulnerability being exploited against online stores, a red team will simply exploit those—without providing the detailed remediation guidance a pen test delivers.
Common mistakes that waste time and money
Mistake 1: Scoping too narrow. Testing only your public website when attackers will phish your employees and pivot to internal systems leaves the real risk unexamined.
Mistake 2: Treating pen tests as compliance checkbox exercises. Receiving a report, filing it, and doing nothing with the findings means you'll fail the same tests next year—and attackers will succeed where testers did.
Mistake 3: Red teaming without detection capabilities. If you don't have logging, SIEM, or a SOC, a red team will walk through your environment undetected and you'll learn nothing except that you have no visibility.
Mistake 4: Not retesting after remediation. Developers fix what they think is the vulnerability; a retest confirms the fix works and didn't introduce new issues.
The Binance theft of $6.3 billion traced to a compromised DevOps laptop shows what happens when endpoint security, privileged access, and monitoring all fail. A red team exercise would have tested exactly that chain.
Your action plan: next 30 days
Week 1: Inventory and prioritize. List your internet-facing assets, critical applications, and compliance requirements. Identify what hasn't been tested in the last 12 months.
Week 2: Define objectives. Decide whether you need vulnerability identification (pen test) or detection validation (red team). For most readers of this article, the answer is pen test.
Week 3: Select a provider and scope. Look for firms with OSCP, OSCE, GXPN, or GPEN certified testers. Verify they provide detailed remediation guidance, not just automated scanner output. Confirm they'll retest critical findings after you remediate.
Week 4: Prepare your environment. Ensure you have backups, document system owners, and get legal/executive sign-off. For red teams, define rules of engagement and objectives with leadership.
Both assessments require preparation, skilled execution, and—most importantly—acting on findings. The TeamViewer flaw that lets controlled machines attack the controller and the malicious Claude Code extension that planted SSH backdoors on developers are the kinds of supply chain and trust-boundary issues that sophisticated testing surfaces.
Vici Tech Solutions conducts both penetration testing and red team exercises tailored to your industry, maturity, and compliance needs—contact our team to discuss which assessment makes sense for your organization.