What is red teaming? Understanding the difference between red teaming and penetration testing

Many organisations use penetration testing to assess cybersecurity defences, but few truly understand what red teaming involves or when it’s the better choice. This guide explains what red teaming is, how it differs from traditional pen testing, and when your organisation should use each approach to strengthen resilience against real-world attacks.

We’ll compare this to penetration testing, and in doing so you’ll be able to see the similarities and differences between the two disciplines.

Finally, we’ll make the case that your organisation will almost certainly benefit from engaging in a red teaming exercise, especially if you are already performing regular pen tests or other offensive security-focused activities.

What is red teaming?

Red teaming is a simulated attack designed to test not just your systems, but your people, processes, and physical defences.

 View our Red Team Testing service

Unlike a penetration test, which focuses on identifying and exploiting technical vulnerabilities, a red team engagement mirrors how a real attacker would approach your organisation. It combines social engineering, phishing, physical intrusion, and technical exploitation to achieve a defined objective, such as gaining access to sensitive data or disrupting business operations.

In simple terms, penetration testing finds the holes. Red teaming shows what an attacker could do once they’re through one.

But where did it originate? Follow on for a very brief history lesson…

A brief history of red teaming

Prussian Roots

As with most things of an adversarial nature, red teaming found its roots in the military. Specifically, the 19th-century Prussian military which you are no doubt familiar. They were trying to simulate battles and train officers in strategy and decision-making, whilst smartly avoiding the need to mobilise thousands of troops for a dress rehearsal.

In doing so, they developed what would become the first type of modern wargaming, with people on two sides playing over a tabletop, covered in a terrain map. The map would have small, wooden, painted tokens on it representing various sets of troops.

They’d pass their instructions to an umpire who would move the troops around and decide on the actual outcomes of those actions. This would include things like how many casualties were suffered and other incidentals, and the umpire would introduce random elements using dice rolls.

Here’s the trivia: these Prussian wargame pieces would be painted two different colours to represent the sides: the home team was normally painted blue, and the enemy side would be painted – you guessed it – red.

Needless to say, it was a huge hit.

The Prussians perfected their wargaming, which translated to numerous victories on the battlefield. Word soon spread that the Prussians were effectively tabletop gaming and winning wars. The technique eventually spread to neighbouring military powers who presumably, also kept the ‘red equals enemy’ colour scheme.

And so, the Prussian-invented wargaming (or Kriegsspiel in German – which, somewhat self-evidently, translates to ‘war game’) became the go-to method for simulating battles and honing strategy from the comfort of your own war room.

We can say that the purpose of the wargame’s red team was to simulate the enemy to identify weaknesses and vulnerabilities in the blue team’s plan. We’ll keep this definition close as it will be handy for later.

As an aside, the Kingdom of Prussia ceased being in 1871 and it’s doubtful that the military boffins of the time could have anticipated the far-reaching impact that their wargaming would have on Western culture.

One could argue that anyone who has ever enjoyed a campaign or two of Risk or Warhammer 40,000 should tip a hat to the Prussians for doing the groundwork, but we digress…

Corporate trunk

It is unclear who the first CEO was to read Sun Tzu’s The Art of War and liken it to the business landscape; however, the adversarial, almost militaristic mindset was popularised by 20th-century thinkers like Peter Drucker and Michael Porter.

Their ideas on business management would change the way that leadership teams approached and operated their business, and we’d see the narrowing of focus into areas such as business strategy, industry and competitor analysis.

These are all terms that have long been part of the corporate zeitgeist for decades and are the mainstay of many a boardroom. And just like the military commanders of yesteryear, corporations would create their own red teams to simulate competitor and market reactions to their plans.

In one way, you can view red teaming as an extremely hands-on SWOT analysis; this was about accurately identifying weaknesses before a competitor. In the same way the military did, no potential competitor strategy was off the table.

Cybersecurity branches

Time moved on and computers proved themselves somewhat useful. For a time, the increased reliance on computers in business and the proliferation of computer networks globally outstripped the appetite to properly secure these systems, and it would take many years (and high-profile incidents) for computer security to be given the importance that it has today.

As the nascent cybersecurity sector grows, an idea develops, borne of the groups of thankfully benign, technically gifted computer enthusiasts who enjoy the process of understanding and exploring computer systems.

These self-titled ‘hackers’ start to see the ever-growing dangers of computer systems and software that contain vulnerabilities and begin to engage with corporations to (sometimes) responsibly disclose these issues before the bad guys find them.

Some companies treat these hackers as a nuisance at best, criminals at worst. Other, more forward-thinking organisations start to ask questions like “What other vulnerabilities can you find in our systems?” and, more importantly, “What does a cyber attack actually look like and could we handle one?”.

The hackers of the day said, “Yes, we can simulate a full-blown attack for you and give you a report of what we found” and the practice of red teaming for business strategy has now entered the realms of security and red teaming as a cybersecurity practice is born.

History lesson over, we can now state with confidence that red teaming is an exercise that simulates a real-world adversary targeting an organisation using the tactics, techniques and procedures of real malicious actors. 

But isn’t that what pen testing is?

Well, not quite.

Red teaming vs penetration testing: key differences

A red team test is stealthier and typically plays out over an extended period of time to make it less obvious. It will often consist of multiple stages. For example, it may include social engineering attacks to harvest account credentials and access systems or even physical attacks, during which testers seek to gain access to offices, systems and data held onsite.

While the goal of a penetration test is usually to uncover as many exploitable vulnerabilities as possible, the goal of a red team assessment is to achieve a specific objective – typically to access target data or systems.

Because the wider IT or security team is kept in the dark, a red team exercise tests the ability of the defenders (the ‘blue team’) to detect the attack and respond to it.

Ocean’s Eleven (2001) is a great film to make an analogy about the differences between pen testing and red teaming. In the film, our motley ensemble hatches a plan to steal a great deal of money from the vault of the casino at the Bellagio in Las Vegas.

As with any great heist film, a good deal of attention is paid to the planning; the team gathers information about the target from a variety of sources, including blueprints of the vault itself, profiles of key people, security guard composition and shift patterns.

They then devise a plan to steal the loot and practise their plan against a mocked-up version of the casino vault, create contingencies, backups and perfect the many layers of deception and subterfuge required to execute successfully.

Then they execute the plan against the real casino and *spoiler alert!* break into the vault and make off with the money.

This is a great analogy of what happens in a red team engagement: we look at the organisation as a whole and attempt to identify a chain or chains of vulnerabilities that we can exploit to achieve some specific objectives.

Remember: Red teaming is a simulation of an attack by a malicious actor, so there might be multiple objectives depending on the type of simulation run.

In the world of Danny Ocean and his red team, this could be anything from ‘steal the hundred-and-fifty million dollars in the casino vault’ to ‘get one of our operatives working on the blackjack table’ or even ‘infiltrate the CCTV room and take control of the camera feeds’ (all of which they do in the film).

In fact, had Ocean and his team concluded the heist by giving the Bellagio its money back with a report detailing how they achieved their goals and what the security response was, then Ocean’s Eleven would likely be one of the highest-grossing films about the need for organisations to perform red team engagements of all time.

How red teaming works in practice

In a red team engagement, we take a more holistic approach to your security assessment, and it necessarily comes with a broad remit because, well, the bad guys tend not to care too much about whether something is in or out of scope.

Red teaming will naturally, on its way to the vault, do things like:

• Test the security of your critical infrastructure (can we break into your vault?)
• Evaluate your security awareness and response (can we sneak past your security guards unchallenged?) and
• Test lateral movement protections (can we get into the more secure room from a less secure one next door?).

But you should only expect a red team engagement to test these things in as much detail as is necessary to achieve the objective.

Red teaming, by its very nature, will not provide a large amount of coverage for all of your security systems. Again, it is a simulation so things are happening in real time.

The red team operators are executing the plan in real-time and going head-to-head with your security operations and measures. If, for example, a red teamer is detected scanning your internal network and your Security Operations Centre (SOC), then that might result in them losing their foothold on the network and needing to find an alternative way back in.

The opposite is also true: if a red team has a clear objective (can we steal the money?), a decent foothold and is hitherto undetected, they are going to do everything in their power to maintain that foothold and not run the risk of inducing a security response by poking around for completeness’ sake.

Compare this to pen testing, where the goal is arguably to identify as many vulnerabilities as possible, but within a very limited scope.

Were Danny Ocean and his team were performing a pen test, they might start with checking all the external entrances, exits, fire escape,s and accessible windows there are, noting down their makes and models, checking to see if any were unlocked or could easily be bypassed. They might then move on to check the lifts, note the positions of all the security cameras, looking for blind spots.

In a pen test, the scope can be almost arbitrarily small – think “Can you test this button within this application” small – and the varying disciplines are often split into discrete phases.

So, one phase might be testing only the external infrastructure, another testing only the internal infrastructure, a third being only the Wi-Fi networks. Each phase might be scoped as large as the organisation’s entire network or down to just a few IP addresses.

Before a penetration test, the tester is often provided with low-privileged credentials to access the system or navigate the infrastructure. It’s also generally required that things like firewalls are set to ignore traffic from the tester’s IP address.

This is the equivalent of Terry Benedict, the fictional manager of the Bellagio, telling his security staff that if they see a person wearing an Evalian-branded jumper acting suspiciously, don’t apprehend them. They’re doing a security test.

Additionally, the report that you receive from a pen test will reflect this coverage. A good pen test report will lay out that of the 117 internal security doors tested, 42 were using an old four-digit pin-style lock, which is considered insecure and should be upgraded to an RFID scanner or better.

A red team report is likely to highlight that they were able to gain access to the back office by shoulder-surfing an employee at a door, which only needed a four-digit pin, which they read over the employee’s shoulder.

How Red Teaming Uses Social Engineering

We’ve been talking about red teaming with our cybersecurity hats on, which naturally means that we’re thinking of doing sneaky things with computers. But, as we said before, a pure red team engagement simulates a real-world attack.

This means that in a classic red team engagement, you’re as likely to have operators picking locks and charming their way through reception or tailgating employees through barriers.

Physical and digital tactics

Other methods, such as phishing (tricking someone by email), smishing (tricking someone by text message) and vishing (tricking someone by phone call) are also likely to be employed.

A determined assailant is going to use all of the tools at their disposal to achieve their goals, so if your red team doesn’t do the same, there’s a huge space for a false sense of security to develop post-engagement.

Limitations and ethics

Whilst the scope of a red team engagement is broad, it naturally doesn’t involve anything illegal, which includes anything which permission isn’t explicitly granted for. So operators won’t attempt to gain access to your building from nearby, privately owned buildings for example.

They also won’t attempt to perform any supply chain attacks, where access is gained through compromising a supplier first. They also won’t dig tunnels, hijack delivery vehicles or kidnap your staff members, as exciting as that may be.

This isn’t to say that pen testing isn’t a ‘real’ thing, or that pen testers aren’t real (we are, promise). However, the scope limitations of pen tests alongside the ‘computer first’ approach (this is cybersecurity after all) mean that most of the objectives set out in a pen test can take place remotely.

It is prudent to mention at this point that there is a type of penetration test known as a physical penetration test. This is another circle in the Venn diagram of security testing as it looks specifically at the physical controls in place at an organisation and it tests things like whether staff members challenge you, if it was possible to gain entry to the building via a fire escape and whether you can get into the computer room via an air vent in an adjoining room.

Red teaming takes place over a longer period

A common caveat that you’ll find on any penetration test report will be a gentle reminder that whilst all efforts were made to identify all the vulnerabilities in your system, a determined attacker with an unlimited amount of time might well be able to find and exploit vulnerabilities that weren’t found during the testing window.

This is especially true if you’re unlucky enough to find yourself up against a nation-state threat actor. Nations will commonly spend years and hefty sums of money gaining access to organisations.

Even automated attacks from ‘script kiddies’ can easily be run for weeks at little expense to the attacker. Whereas a typical penetration test might last a week.

Red teaming requires the operators to gather a huge amount of information about your organisation beforehand. It might also involve visits to scope the site out and observe staff movements, creating phishing emails or trying to clone a staff member’s keycard when they’re in line at the local coffee shop.

Either way, it is not uncommon to have red team engagements which last weeks or even months, because doing so creates a more accurate simulation of your organisation under attack from a persistent threat.

Five reasons you should consider red teaming

You want to stay ahead of the curve

Cybercriminals are creative. It is this very creativity that attracts so many (not evil) people to the field of cybersecurity. Criminals are constantly evolving and have what seems like an unlimited innovation budget.

Red teaming allows you to step into their shoes (minus the ethical ambiguity) and test your defences against the latest techniques. Red teaming is the best option available to let you know if you’re prepared for what is to come as well as what is out there now.

You want to know exactly how your security holds up

Despite the Prussian successes, tabletop exercises for incident response can only go so far. You still want to find out how your team actually performs against a quiet, well-prepared and determined adversary.

Red teaming simulates actual attacks, which means that your team will be detecting and responding in real-time. It’s a dress rehearsal for your incident response plan.

You need to protect the irreplaceable

Every organisation has assets it can’t afford to lose; sensitive customer data, proprietary designs, intellectual property or, occasionally, that one server nobody is allowed to reboot.

Red teaming focuses on these high-value targets to see if they’re as secure as you think because you’ll have a team of people trying to break into your vault and steal your money. And if it isn’t as secure as you’d hoped, at least you’ll find out before someone else does.

You want to create a culture of security

Red teaming doesn’t just stress-test your security systems; it stress-tests your people. A few well-placed phishing emails or vishing calls can do wonders for raising awareness, especially on an ongoing basis. And, if done correctly, it’s seen as a learning experience rather than a soul-crushing ‘I dropped the ball’ scenario.

Over time, these exercises help build a culture where security isn’t just IT’s job – it’s everyone’s responsibility. Red teaming can help to put that at the forefront of your organisation’s culture.

You’ve maxed out on pen testing

So maybe you’re reading this and thinking that you’ve already got your bases covered; you get regular pen tests on all your systems and applications, run phishing campaigns, operate zero trust networks and maybe even have multi-factor access controls for your building which include biometrics.

Now it’s time to put all of those things together and test them against a determined adversary. Even the best security posture isn’t proven until it’s tested, and red teaming is the best methodology for finding out just how well it stacks up.

Who should use red team testing?

So, with the above in mind, as a general rule, red teaming should be reserved for organisations that consider themselves to have a mature cyber security posture or a much larger attack surface that could be exploited by a capable adversary.

If your organisation’s cyber security defences are weak, it makes little sense to start with a red team test. Instead, you should begin with the basics of vulnerability identification and management.

Therefore, for most organisations, we tend to advocate continuous vulnerability scanning and regular penetration testing as the best approach. Vulnerability management is a basic security hygiene step and penetration testing provides a more detailed assessment and identification of issues.

As your security posture becomes mature and regular penetration identifies a few vulnerabilities, you can consider layering in red team assessments to understand the strengths and weaknesses in your security defences and culture that need to be addressed.

How much does red team testing cost?

Testing costs vary depending on the complexity of the systems and infrastructure. Take pen testing for example, there are a couple of different levels of external infrastructure that can be carried out, whether you simply need a single-approach method, or if your budget allows a more advanced external infrastructure assessment.

Read our in-depth blog to understand the costs of penetration testing. If you’d like some help with understanding how to scope a penetration test or red team assessment, before you speak with a provider, read our guide to scoping a penetration test. 

Need help with red team testing or pen testing?

If your organisation needs help with Red team testing, and you are further along in their cyber security journey, we offer red team assessments.

If you’re running a penetration test on an application or infrastructure, we’re here to help. Contact us today.

Designed by vectorpouch / Freepik