What is a red team exercise and how is it different from a pentest?

As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.

What is a red team exercise?

A red team exercise is a sustained, objective-driven attack carried out by operators given your infrastructure and little other information, over days or weeks, with a defined target such as the customer database, the payroll approval flow or an executive mailbox. The engagement is judged on whether the team reached the objective and how, and every action is logged with timestamps, because the report is a narrative of what a real adversary did, in what order, over which weaknesses. The exercise also measures detection in parallel, since an attack that was never noticed tells you about your perimeter but nothing about your monitoring, and knowing which of the red team's actions were logged and which were not is usually the most valuable output.

How is a penetration test different?

A penetration test is defined by an agreed list of assets and techniques inside a defined window, and it answers the question, is there a way in and how far does it go against these systems. It produces a findings list with reproduction steps, severities and remediation guidance. A red team is defined by a goal, is allowed any lawful route including your people, your physical site and your suppliers, and answers the question, can a motivated adversary reach this specific outcome. It produces a story with a timeline, the control that failed first, and the controls that never fired. A test is a snapshot of technical weakness; a red team is a simulation of a campaign.

Which one should an Indian company buy first?

The penetration test, almost always, for a simple reason of cost efficiency. A red team is a large investment, and running one before the obvious technical weaknesses are fixed means paying a premium to be told about findings a vulnerability assessment would have surfaced for a fraction of the cost. Once a penetration test has been remediated and retested clean, the red team becomes genuinely informative, because it starts from the position an attacker would actually find, and it tests the parts a test cannot reach: your people, your process, your third parties and your detection. Most Indian firms add the red team in year two or three, after a cycle of assessment and retest has proved the remediation process works.

What is a purple team, and where does it fit?

A purple team is the collaborative exercise that follows a red team, where your defenders and the testers work in the same room on the red team's findings. The red team identifies what it did and what it got past; the purple team works out why each detection did or did not fire, tunes the rules and the logging, and rehearses the response. It is the most cost-effective of the three exercises per rupee, because it converts a set of findings into working detection capability. The practical Indian sequence is an annual red team, quarterly purple team detection tuning, and continuous vulnerability testing in between, which is a defensible programme rather than a single purchase.

What are the frequently asked questions?