Red Team vs Penetration Test vs Vulnerability Assessment vs Purple Team: Which One and When?

Quick answer: These four services answer different questions. A vulnerability assessment asks "what vulnerabilities exist," scans broadly but does not exploit. A penetration test asks "are these vulnerabilities actually exploitable," proving them within a defined scope. A red team asks "would a real attacker reach our target, and would we notice," working intelligence-led, covert, objective-based and usually with an assumed-breach approach. A purple team is not a separate test but a real-time collaboration model between the red (offense) and blue (defense) teams, closing each attack step with either a confirmed detection or a new detection rule. The right choice depends on the organization's security maturity: vulnerability management and pentest first, red and purple team as it matures.

The most common mistake when companies buy security services is buying a different service than they need. Mistaking a scan report for a "penetration test," or selling a red team to a company without basic hygiene, both wastes budget and creates a false sense of security. Vendors often use these four terms interchangeably; yet the difference between them is large, in both cost and the security obtained. This article separates the four services with defined frameworks and shows which is needed when. Our pentest types guide on scope and the PTES, OWASP, OSSTMM, NIST standards comparison complement this guide.

Vulnerability Assessment

A vulnerability assessment is the systematic identification of known security weaknesses in systems; it is usually done with automated scanners and lists vulnerabilities without exploiting them. NIST's information security testing guide SP 800-115 defines this distinction: vulnerability scanning identifies weaknesses; penetration testing verifies them by actually exploiting. A vulnerability assessment is ideal for broad scope, low cost and frequent repetition; it is the foundation of continuous vulnerability management and measures an organization's basic hygiene. But it does not tell you which vulnerability is truly dangerous, that is its real exploitability; a scanner can produce hundreds of "high" findings, most of which cannot be exploited in that environment. For continuous management see our AI-assisted automated vulnerability scanning.

Penetration Testing

A penetration test, in NIST SP 800-115's definition, is testing in which assessors mimic real-world attacks to find methods of circumventing security features; it goes beyond vulnerability scanning by actually exploiting weaknesses. It works within a defined scope and time window, shows found vulnerabilities with an executable proof of concept and provides a remediation roadmap. Where a scan says "this might be a vulnerability," a penetration test says "this vulnerability exists and is exploited like this." Per CREST guidance, a penetration test looks for exploitable weaknesses within a defined scope; a red team is broader and more realistic. For most organizations an annual penetration test is the right starting point for compliance (for example ISO 27001 Annex A.8.8 and A.8.29 expectations) and real risk. Separate penetration tests are planned for specific surfaces such as web, API, internal network and cloud.

Red Team

A red team is a broad-scope, covert, objective-based attack simulation. The question is no longer "does this system have a vulnerability" but "would a real attacker reach a specific objective (for example the customer database or payment system) and would the defense team detect and stop it." A red team differs from a pentest in three ways: it is covert (the defense team usually does not know, so real detection capability is measured), objective-based (it seeks a path to a specific outcome, not all vulnerabilities) and realistic (it emulates real attackers' tactics). Red teams use the MITRE ATT&CK knowledge base: a globally accessible catalog of real adversaries' tactics and techniques (TTPs) that lets the red team emulate a real adversary and map scope in a standard language. A modern red team usually starts with an assumed-breach approach: the team measures detection and response while already holding a foothold inside. This focuses on the detection-and-response stage where the real value is, rather than spending days breaking the perimeter. We covered how this methodology evolves in the AI era in our AI red teaming article.

Purple Team

A purple team is not a separate team or test; it is a collaboration model fusing the red (offense) and blue (defense) teams. The red team runs an attack technique while the blue team watches the telemetry in real time; each technique ends either in a confirmed detection or a detection-engineering fix. Unlike a covert red team, the goal is to train the defense in real time and measurably increase detection capability. For example the red team runs Kerberoasting and the blue team confirms it appears in the logs; if it does not, a detection rule is written immediately and re-tested. A purple team is most productive when the defense team (SOC) has matured and is the bridge between a red team and vulnerability management.

A regulated framework: TIBER-EU

For financial infrastructures, the European Central Bank's TIBER-EU framework standardizes intelligence-led ethical red-team tests: it mimics real attackers' tactics against critical functions (people, processes, technology) in a controlled way. The outcome is not pass or fail but revealing strengths and weaknesses to raise cyber maturity. TIBER-EU helps meet the threat-led penetration testing (TLPT) requirements of the EU Digital Operational Resilience Act (DORA). This is an example of how red teaming has been institutionalized as an industry standard and shows that in regulated sectors a red team is no longer a luxury but a requirement.

Which one when: a maturity-based path

  1. No basic hygiene: vulnerability assessment. If patch management, asset inventory and basic hardening are not yet in place, start with broad vulnerability scanning; a red team is a waste of money at this stage because the most basic gaps are already obvious.
  2. Basics in place: penetration test. Prove the real exploitability of specific systems (web, API, internal network, cloud). For most organizations an annual pentest is the right level and also meets compliance requirements.
  3. A defense team exists: red team. If you have built a SOC or detection capability, a red team measures whether you can detect and stop a real attack; that is, it answers not only "do I have a gap" but "will I see the attack."
  4. To improve detection: purple team. When a red team reveals a gap, a purple team turns that gap into a durable detection through collaboration and trains the defense team.

Comparison summary

Service Question Scope Exploit Covert Maturity
Vulnerability assessment What gaps exist Broad No Open Starting
Penetration test Is it exploitable Defined Yes Usually open Basics in place
Red team Is the objective reached, is it seen Objective-based Yes Covert Has a defense team
Purple team How do we improve detection Technique-based Yes Collaborative Mature SOC

The DSET approach

At DSET we position these services according to the organization's maturity; we do not sell the wrong service. Selling a company more or less than it needs is both unethical and ineffective. In every test we present findings with verified evidence; we explained why this matters in verified vulnerabilities and false-positive-free testing. All tests run authorized with written scope; see the penetration testing contract and legal authorization.

Frequently Asked Questions

Does a vulnerability scan replace a penetration test? No. A scan lists vulnerabilities but does not prove their exploitability; a penetration test does. They serve different purposes and are used together.

Can I go straight to a red team? Technically yes, but without basic hygiene and a defense team a red team's value drops; a pentest and vulnerability management are recommended first.

Do I need a separate team for purple teaming? No. A purple team is a model; it runs through real-time collaboration of your existing offense and defense resources.

Which is most expensive? Usually a red team is the most comprehensive and costly and a vulnerability assessment the most economical; but buying the wrong one is always the most expensive.

Sources

To discuss which service fits your organization, contact DSET.