Vulnerability Scan, Penetration Test or Red Team: Choosing the Right Exercise

Four exercises get used interchangeably in procurement conversations and answer completely different questions. Buying the wrong one is the most common way organizations spend a security budget and learn nothing, so the distinction is worth being precise about.

Vulnerability scanning: what is wrong

Automated, broad and shallow. A scanner enumerates hosts and services, identifies software and versions, and reports known vulnerabilities and misconfigurations.

It answers "what known weaknesses exist across the estate," runs continuously, and costs very little per asset. It does not confirm anything is exploitable, does not chain findings, and produces false positives and negatives — the matching problems described under CPE.

Authenticated scanning finds substantially more than unauthenticated, and running it is the baseline hygiene that should be in place before anything else is purchased.

Penetration testing: what is exploitable

Manual, scoped and deep. A tester attempts to exploit weaknesses and to chain them, establishing what an attacker could actually achieve within the defined scope.

It answers "can these weaknesses be used, and how far does that get someone." It finds the things scanners cannot — authorization flaws, business logic errors, and combinations where three medium findings produce full compromise. It is a point-in-time assessment, bounded by scope and by the days purchased.

The scoping decisions — black, grey or white box, what is in scope, whether the goal is compliance coverage or realistic assessment — determine the value more than the tester's skill does, which is the argument made under choosing a penetration testing provider.

Red teaming: would we notice

This is the distinction most often missed. A red team exercise is objective-based and adversarial: the team is given a goal — reach this data, achieve this level of access — and works toward it using whatever combination of technical, social and sometimes physical means is in scope, over weeks or months, while deliberately trying to avoid detection.

The subject being tested is not the technology. It is the detection and response capability — the security team, the tooling, the processes. A red team exercise where the defenders knew the dates and the source addresses has tested nothing.

Which means the blue team must not know, and a small number of people — the white cell — hold the knowledge, arbitrate, and can stop the exercise. The deliverable is a timeline showing what the red team did and what the blue team saw, and the interesting content is the gap between them.

Red teaming is expensive and only worth buying once detection capability exists. An organization with no monitoring does not need to pay someone to prove it.

Purple teaming: how do we improve

Collaborative rather than adversarial. Offensive and defensive staff work together, executing techniques deliberately and checking in real time whether telemetry was produced and whether a detection fired.

It answers "which techniques would we detect, and how do we fix the gaps." It is cheaper than red teaming, produces more improvements per day, and lacks the realism of an unannounced exercise. The structured version is the control validation described under adversary emulation.

For most organizations purple teaming delivers more value per pound than red teaming, and the mature pattern is purple to build capability, red periodically to test it honestly.

Choosing

Map the question to the exercise. What weaknesses exist? Scanning. Can they be exploited, and how badly? Penetration test. Which attack techniques would we detect? Purple team. Would we actually notice and respond to a real intrusion? Red team.

Sequence matters too. Scanning findings should be remediated before a penetration test, or you pay a skilled tester to rediscover them. Detection capability should exist before a red team exercise. And a compliance requirement frequently specifies which exercise satisfies it, which may not be the one that would teach you most — in which case buy both and be clear which is which.

All of them require written authorization, defined scope and rules of engagement, and all of them produce findings that need owners and dates rather than a filed report.

Exam angles

Distinguish vulnerability scanning (automated, broad, identifies known weaknesses, does not exploit), penetration testing (manual, scoped, exploits and chains, point-in-time), red teaming (objective-based, adversarial, covert, tests detection and response) and purple teaming (collaborative, improves detection coverage). Know that the red team's subject is the defensive capability rather than the technology, requiring that defenders be unaware, and that scanning precedes testing which precedes red teaming in maturity.