These two get quoted against each other as though they were the same job at two price points. They are not the same job. They answer different questions, they need different things to be in place first, and buying the wrong one is how companies end up with an expensive report that tells them nothing they can act on.
The questions are different
A penetration test answers: what here can be exploited? It is a breadth exercise. We are given a scope and we work through it systematically, because the point is coverage - you want to end up with a list of everything that could be used against you, each with the proof and the fix.
A red team answers: would anybody notice, and how fast? It is a depth exercise with one objective - reach the payment system, read the board papers, get domain administrator - and any route is allowed. Coverage is explicitly not the goal. If we find three ways in and use the quietest one, the other two go in the report as observations, not as the work.
Who, by name, would see the alert? If you can answer that - a person, a team, an MSSP with a contract and an escalation path - a red team will tell you something valuable. If you cannot, you already know the answer and you would be paying us to prove it slowly.
What a red team needs in place first
We turn down more red team enquiries than we accept, and this is usually why. Four things have to exist for the exercise to produce anything:
- Logs that reach somebody. Not logs that exist. Logs that arrive somewhere a human or a rule looks at them.
- An incident process. Detection you cannot act on is a timestamp, not a defence.
- A recent penetration test. Otherwise the first day of the red team is spent finding an unpatched edge device, and you have paid red-team rates for a result a network test would have produced in an afternoon.
- Somebody senior who is in on it. A white-cell contact who can stop the exercise, confirm we are us at three in the morning, and keep the engagement from turning into a real incident response.
Three out of four is usually workable. One out of four means you want a penetration test this year and a red team next year, and we will say so even though the red team is the larger invoice.
Assumed breach: the one most people should buy
Full-scope red teaming starts from outside with nothing, which means a meaningful part of the budget goes on getting in at all - and if your perimeter holds, you have bought an expensive confirmation of that and learned nothing about the inside.
Assumed breach skips the argument. We are given a normal user account, or a laptop on the network, which is exactly where a phishing email or a bought credential would leave an attacker. Everything after that is the part you actually wanted tested: how far it goes, how fast, and what your tooling says while it happens. For most organizations this is the honest version of a red team at two-thirds of the cost.
Purple team: when you want the answer rather than the score
A red team tells you what was missed. A purple team fixes it while you watch. We run a technique, your defenders look for it in their own tooling, and if nothing fires we work out together why - log source missing, rule too narrow, alert going to an unwatched queue - and try again.
It is less dramatic and it improves detection faster than anything else we sell. If your last red team ended with “you did not see any of it”, the next engagement should probably be this one rather than another red team.
What each one leaves you holding
- Penetration test. A list of findings, each risk-rated, each with reproduction steps and a fix. Work for your engineers, and a document your auditor or enterprise customer will accept.
- Red team. A narrative: this is what we did, in order, with timestamps, and this is what your tools recorded against each step. Work for whoever runs your detection, and an uncomfortable hour for the board.
- Purple team. A before-and-after per technique, and rules that fire at the end which did not fire at the start.
If a regulator is driving this
Be careful which word is in the clause, because they are not interchangeable in a framework either. SAMA’s Financial Entities Ethical Red Teaming framework puts domestic systemically important entities through red teaming once every three years; its Cyber Security Framework separately requires annual penetration testing of customer and internet-facing services at 3.2.4. Those are two obligations, not one, and a red team does not discharge the pentest clause. We have written up what the Gulf regulators actually require, clause by clause.
If you are not sure which you need, the fastest way to find out is to tell us what you are afraid of rather than what you want to buy. The red teaming page sets out how we run the full exercise, and we will tell you honestly if a penetration test is the better use of the money this year.
Where these numbers come from
Every figure above is from one of these. If one of them has moved on since we wrote this, believe the source and not us.
Choosing between them
How do we know whether we are ready for a red team?
Answer one question: who, by name, would see the alert? If you can name a person, a team or an MSSP with an escalation path, a red team will tell you something. If you cannot, you already know the result and the money is better spent on a penetration test and a year of getting logs in front of somebody.
Is assumed breach a cheaper red team or a weaker one?
Cheaper and usually more useful. Full scope spends a meaningful part of the budget getting in at all, and if your perimeter holds you learn nothing about the inside. Assumed breach starts where a phishing email would leave an attacker, which is the part most organizations actually need measured.
Will a red team satisfy our annual penetration testing requirement?
No, and the frameworks treat them as separate obligations. SAMA requires annual penetration testing of customer and internet-facing services at 3.2.4, and separately puts domestic systemically important entities through red teaming every three years under the F.E.E.R. framework. A red team is a depth exercise with no coverage guarantee, so it cannot evidence a clause that asks for coverage.
How many people on our side should know it is happening?
Very few, and at least one. The exercise is worthless if the SOC is expecting it, and dangerous if nobody senior can confirm we are us at three in the morning or stop the thing if it turns into a real incident response. Two or three named people is normal.
Want this done on your own systems?
We scope the work in writing first, so you know exactly what will be touched and when.
Book a free consultation Back to the blog