A penetration test finds the holes. A red team finds out if anyone notices.

The question each answers. A penetration test asks what an attacker could exploit in a defined scope, so it aims for coverage and ends in a list of fixes. A red team asks whether your organisation would detect and stop a capable attacker pursuing a specific objective, so it operates covertly across people, process and technology and ends in a timeline of what happened and what your defenders saw. One tests systems; the other tests the defence around them. See our red team assessment page for how an engagement runs.

No — it is different, and it only pays off on the right foundations. If high-severity findings sit unfixed or nobody reviews alerts, a red team will mostly confirm what a cheaper penetration test would have found in more detail. Once testing and fixing are routine and monitoring is in place, a red team tells you something a penetration test cannot: whether your detection and response work under realistic conditions. Most organisations should run penetration tests first and keep running them after they start red teaming.

Ours typically run three to six weeks of active work, after a planning stage to agree objectives, rules of engagement and the control group. The pace is deliberately realistic — a capable attacker does not rush — so it takes longer than a penetration test of the same organisation. Regulator-led frameworks such as TIBER-EU and CBEST add a separate threat-intelligence phase and more formal stages, so they run longer again.

An exercise in which attackers and defenders work together openly. Attack techniques are run one at a time with the defenders watching, and after each one the team checks whether it was logged, whether it alerted and whether anyone would have acted. Gaps are fixed on the spot and the technique is repeated. It is often the most useful first step for an organisation that has never been red teamed, and it makes a later covert exercise much more informative.

Yes, for some entities. SEBI’s Cybersecurity and Cyber Resilience Framework of August 2024 requires market infrastructure institutions and Qualified regulated entities to conduct red-teaming exercises as part of their cybersecurity framework. Other categories of regulated entity have VAPT and audit duties but not this one. Check your category and the full list of obligations in our SEBI CSCRF checklist.

The term the EU’s Digital Operational Resilience Act uses for regulator-driven red teaming. Under Article 26, financial entities identified by their authorities must carry out advanced testing by TLPT at least every three years. TIBER-EU, the European framework for threat-intelligence-based ethical red teaming, is used to meet that requirement. An Indian firm meets TLPT mostly as a supplier: a European bank’s test may reach systems you run for it, and the bank will ask you to take part.

It should not, and the rules of engagement are there to make sure it does not. Before anything starts, the objectives, permitted techniques, systems that are strictly out of bounds, testing windows and a stop condition are agreed in writing with a named control group who can halt the exercise at once. Fragile or safety-critical systems — operational technology, medical devices, live control systems — are excluded from active testing unless their owner gives explicit written instruction.

Penetration testing at least once a year and after significant changes — and more often if your systems change weekly, which is where scheduled testing between full assessments helps. Red teaming is periodic rather than annual for most organisations: often every year or two once the foundations are in place, or on the cycle a regulator sets, such as DORA’s three years for TLPT. Our continuous penetration testing page covers testing between full assessments.