Red Team vs Penetration Test vs Vulnerability Assessment vs Purple Team: Which One and When?

Quick answer: These four services answer different questions. A vulnerability assessment asks "what vulnerabilities exist," scans broadly but does not exploit. A penetration test asks "are these vulnerabilities actually exploitable," proving them within a defined scope. A red team asks "would a real attacker reach our target, and would we notice," working intelligence-led, covert, objective-based and usually with an assumed-breach approach. A purple team is not a separate test but a real-time collaboration model between the red (offense) and blue (defense) teams, closing each attack step with either a confirmed detection or a new detection rule. The right choice depends on the organization's security maturity: vulnerability management and pentest first, red and purple team as it matures.

The most common mistake when companies buy security services is buying a different service than they need. Mistaking a scan report for a "penetration test," or selling a red team to a company without basic hygiene, both wastes budget and creates a false sense of security. This article separates the four services with defined frameworks and shows which is needed when. Our pentest types guide on scope and the PTES, OWASP, OSSTMM, NIST standards comparison complement this guide.

Vulnerability Assessment

A vulnerability assessment is the systematic identification of known security weaknesses in systems; it is usually done with automated scanners and lists vulnerabilities without exploiting them. NIST's information security testing guide SP 800-115 defines this distinction: vulnerability scanning identifies weaknesses; penetration testing verifies them by actually exploiting. A vulnerability assessment is ideal for broad scope, low cost and frequent repetition; it is the foundation of continuous vulnerability management. But it does not tell you which vulnerability is truly dangerous, that is its real exploitability. For continuous management see our AI-assisted automated vulnerability scanning.

Penetration Testing

A penetration test, in NIST SP 800-115's definition, is testing in which assessors mimic real-world attacks to find methods of circumventing security features; it goes beyond vulnerability scanning by actually exploiting weaknesses. It works within a defined scope and time window, shows found vulnerabilities with an executable proof of concept and provides a remediation roadmap. Per CREST guidance, a penetration test looks for exploitable weaknesses within a defined scope; a red team is broader and more realistic. For most organizations an annual penetration test is the right starting point for compliance (for example ISO 27001 Annex A.8.8 and A.8.29 expectations) and real risk.

Red Team

A red team is a broad-scope, covert, objective-based attack simulation. The question is no longer "does this system have a vulnerability" but "would a real attacker reach a specific objective (for example the customer database or payment system) and would the defense team detect and stop it." Red teams use the MITRE ATT&CK knowledge base: a globally accessible catalog of real adversaries' tactics and techniques (TTPs) that lets the red team emulate a real adversary and map scope in a standard language. A modern red team usually starts with an assumed-breach approach: the team measures detection and response while already holding a foothold inside. This focuses on the detection-and-response stage where the real value is, rather than spending days breaking the perimeter. We covered how this methodology evolves in the AI era in our AI red teaming article.

Purple Team

A purple team is not a separate team or test; it is a collaboration model fusing the red (offense) and blue (defense) teams. The red team runs an attack technique while the blue team watches the telemetry in real time; each technique ends either in a confirmed detection or a detection-engineering fix. Unlike a covert red team, the goal is to train the defense in real time and measurably increase detection capability. A purple team is most productive when the defense team (SOC) has matured.

A regulated framework: TIBER-EU

For financial infrastructures, the European Central Bank's TIBER-EU framework standardizes intelligence-led ethical red-team tests: it mimics real attackers' tactics against critical functions in a controlled way. The outcome is not pass or fail but revealing strengths and weaknesses to raise cyber maturity. TIBER-EU helps meet the threat-led penetration testing (TLPT) requirements of the EU Digital Operational Resilience Act (DORA). This is an example of how red teaming has been institutionalized as an industry standard.

Which one when: a maturity-based path

  1. No basic hygiene: vulnerability assessment. If patch management, asset inventory and basic hardening are not yet in place, start with broad vulnerability scanning; a red team is a waste of money at this stage.
  2. Basics in place: penetration test. Prove the real exploitability of specific systems (web, API, internal network, cloud). For most organizations an annual pentest is the right level.
  3. A defense team exists: red team. If you have built a SOC or detection capability, a red team measures whether you can detect and stop a real attack.
  4. To improve detection: purple team. When a red team reveals a gap, a purple team turns that gap into a durable detection through collaboration.

The DSET approach

At DSET we position these services according to the organization's maturity; we do not sell the wrong service. In every test we present findings with verified evidence; we explained why this matters in verified vulnerabilities and false-positive-free testing. All tests run authorized with written scope; see the penetration testing contract and legal authorization.

Frequently Asked Questions

Does a vulnerability scan replace a penetration test? No. A scan lists vulnerabilities but does not prove their exploitability; a penetration test does. They serve different purposes.

Can I go straight to a red team? Technically yes, but without basic hygiene and a defense team a red team's value drops; a pentest and vulnerability management are recommended first.

Do I need a separate team for purple teaming? No. A purple team is a model; it runs through real-time collaboration of your existing offense and defense resources.

Sources

To discuss which service fits your organization, contact DSET.