Three different questions
| Exercise | Question it answers |
|---|---|
| Vulnerability assessment | What known weaknesses exist across my assets? |
| Penetration testing | Can those weaknesses be exploited, and how far can an attacker get? |
| Red teaming | Would we detect and stop a realistic, goal-driven attacker? |
Choosing the wrong one wastes budget. A red team against an organisation with unpatched internet-facing systems will simply confirm what a vulnerability scan would have found for a fraction of the cost.
Vulnerability assessment
Broad and frequent. Automated scanning plus analyst validation across networks, hosts and applications.
Best for: continuous hygiene, compliance evidence and prioritising patching.
Penetration testing
Deep and scoped. Testers manually exploit weaknesses in a defined target — a web application, API, mobile app, internal network or cloud tenant — and demonstrate impact.
Best for: new or significantly changed systems, regulatory requirements and validating critical applications. Good tests follow recognised methodologies such as the OWASP testing guides for applications.
Red teaming
Objective-based and stealthy. The team pursues a goal such as accessing payment systems, using any agreed technique — phishing, physical, technical — while the defenders are typically not told when.
Best for: mature organisations with a SOC that want to test detection and response, not just prevention.
Choosing by maturity
- Building basics: regular VA plus annual penetration tests of critical systems
- Established programme: add application tests in the release cycle and assumed-breach internal tests
- Mature SOC: introduce red and purple team exercises mapped to adversary techniques
Getting value from any test
- Agree scope, rules of engagement and emergency contacts in writing
- Require findings with evidence, business impact and clear remediation
- Retest fixes — an unverified finding is not closed
- Track recurring root causes, not just individual bugs
Key takeaways
- Vulnerability assessment is broad, penetration testing is deep, red teaming tests detection and response.
- Choose the exercise that matches your maturity.
- Always retest fixes and track root causes.
Frequently asked questions
How often should we run penetration tests?
At least annually for critical systems and after significant changes, or more often where regulators or customers require it.
Is automated scanning a penetration test?
No. Scanning finds known weaknesses; penetration testing involves skilled manual exploitation to show real impact.
What is purple teaming?
A collaborative exercise where attackers and defenders work together, replaying techniques and tuning detections in real time.
A test that produces a report but no fixes has only measured your risk, not reduced it.
Our VAPT and application security team delivers manual, evidence-based testing for regulated enterprises.
