How do I choose between a vulnerability assessment, a penetration test and a red team engagement?
Key takeaways
- The assessment answers how many weaknesses exist, the penetration test answers whether they can be exploited, the red team answers how far a real adversary gets.
- A red team engagement only produces value once your detection and response process is already credible, so it is not a first purchase.
- Indian red team engagements are typically Rs 3,00,000-15,00,000, a penetration test Rs 60,000-6,00,000 and an assessment Rs 40,000-1,50,000, all excluding 18% GST.
- Most Indian firms can cover 80% of their risk with an annual penetration test plus quarterly vulnerability assessments.
- CERT-In requires listed incidents to be reported within six hours, so a red team without a real notification plan creates compliance risk rather than reducing it.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What question does each engagement actually answer?
The vulnerability assessment is a census: how many weaknesses exist across the estate and how serious are they. The penetration test is a proof: a human attacker tries to exploit them and reports a working path. The red team is a campaign: a goal-oriented adversary with a realistic brief, such as reaching a specific server or dataset, and rules of engagement that define what is out of bounds. Confusing them is common and expensive. Many Indian buyers buy a red team because the word sounds stronger, then discover that their first red team failed to reach the objective because nobody had fixed the misconfiguration the assessment had already found in week one.
What does a red team engagement add that a pentest does not?
A red team tests your process, not just your technology. It exercises escalation paths, lateral movement, credential reuse, phishing of real finance staff and the question of whether your SOC would notice. That is valuable where a mature blue team exists and a waste of budget where nothing is monitored yet, because the exercise simply ends with a report nobody reads. A penetration test in a weaker organisation is usually the better buy. If you have never run a detection exercise, a purple team session or a detection validation exercise will often deliver more risk reduction than a full red team at a third of the cost.
What is the right order and the right frequency?
For a first-year Indian firm the workable cadence is: an assessment to map, a penetration test to prove, remediation, a retest to evidence closure, then a red team once per year. Between the annual test, quarterly assessments keep the estate honest, and quarterly purple team sessions tune detection using the last test's attack paths. The rule of thumb is to spend on the next gap, not the furthest one. An organisation that has never had a test should not buy a red team, and an organisation whose SOC has never been tested should not buy a second pentest before tuning detection.
How much does each one cost in India?
Broadly, a vulnerability assessment for a mid-size Indian estate runs Rs 40,000 to Rs 1,50,000, a penetration test Rs 60,000 to Rs 6,00,000 depending on depth and roles, and a red team engagement Rs 3,00,000 to Rs 15,00,000, all before 18% GST. The underlying rate for all three sits at roughly Rs 12,000 to Rs 30,000 per tester-day, so a quote far below that band is not a bargain, it is a narrower engagement than the one you asked for. Ask each vendor to state the number of tester-days in the proposal, because that number is the only way to compare two quotes that look very different on paper.
| Dimension | Vulnerability assessment | Penetration test | Red team engagement |
|---|---|---|---|
| Question answered | How many weaknesses exist? | Can they be exploited, and how far? | How far does a real adversary get? |
| Typical duration | 3-7 working days | 5-20 working days | 2-6 weeks |
| Indicative cost (ex-GST) | Rs 40,000 - 1,50,000 | Rs 60,000 - 6,00,000 | Rs 3,00,000 - 15,00,000 |
| Best for | Mapping an estate for the first time | Proving exploitability and driving fixes | Testing detection and response maturity |
| Prerequisite | None | Asset inventory and scoped access | Tested fixes, working SOC, agreed rules of engagement |
| Recommended frequency | Quarterly | Annually, plus after major change | Annually, once process maturity allows |
What are the frequently asked questions?
Get a straight answer on this
Tell us which business question you need answered and we will recommend the smallest engagement that answers it, with a fixed price and delivery date.
Send us the details See pricing