Red Team is not a pentest
A pentest has a defined scope and looks to find as many flaws as possible within it. Red Team simulates a real attacker chasing a specific objective, like reaching the production database, testing people, process, and technology together, often without the defense team even knowing they're being tested.
When it makes sense
When a company is already mature enough in security, has already run a pentest before and fixed the basics, and now wants to test its own team's actual detection and response capability, not just prevention. It also makes sense for a company in a regulated industry or one that's a likely target of a directed attack.
When it doesn't make sense yet
If a company has never even run a basic pentest, Red Team is expensive and premature. Better to fix the fundamentals first, and scale up to this kind of exercise later.
Want to assess whether your company is already at the right stage for this?
Request a Red Team Exercise