Buy a penetration test first. It finds the exploitable weaknesses you need to fix and produces the evidence PCI DSS requires and SOC 2 and ISO 27001 auditors commonly ask for. Add a purple team once you have EDR, a SIEM and people watching alerts. Buy a red team when you need proof your defenses detect a real adversary.
The three services answer different questions, so the right order follows from which question you can act on today. A red team bought too early mostly proves what a pentest would have shown for less.
What is the difference between a pentest, a red team and a purple team?
Each service asks a different question. A pentest asks what can be exploited. A red team asks whether you would notice. A purple team asks how to make sure you do.
What is a penetration test?
A penetration test is a scoped, time-boxed assessment in which testers try to find and exploit vulnerabilities in defined systems: a web application, an API, an external perimeter or an internal network. Testers work through a recognized methodology such as PTES, the OWASP Web Security Testing Guide or NIST SP 800-115. The goal is coverage. You get every exploitable finding they can reach in scope, ranked by severity, with proof and remediation steps. Your team usually knows the test is happening.
What is a red team exercise?
A red team exercise is a goal-driven adversary simulation. Instead of listing every flaw, the team pursues one objective, such as reaching customer data or a domain admin account. They use whatever an attacker would: phishing, exposed services, stolen credentials, lateral movement and sometimes physical access. Only a few stakeholders know it’s happening. The output is an attack narrative and a timeline showing what your defenders detected, what they missed and how long the attacker went unnoticed.
What is a purple team exercise?
A purple team exercise puts the offensive team and your defenders in the same room. The testers run specific attacker techniques, usually mapped to MITRE ATT&CK, one at a time. Your SOC checks whether each one generated telemetry and an alert. When something is missed, both sides work out why and fix the detection on the spot. It isn’t covert, so it can’t tell you whether your team would catch an attack on a busy Tuesday. It is the fastest way to close detection gaps you already suspect.
How do a pentest, red team and purple team compare side by side?
The pentest is the broadest and fastest to act on, the red team is the most realistic, and the purple team turns findings into working detections.
| Penetration test | Purple team exercise | Red team exercise | |
|---|---|---|---|
| Question it answers | What can an attacker exploit in this scope? | Do our tools and people detect these specific techniques? | Can an attacker reach our crown jewels without us noticing? |
| Scope | Defined assets: apps, APIs, networks, cloud | Selected attacker techniques, often mapped to MITRE ATT&CK | An objective, pursued across people, process and technology |
| Does your SOC know? | Usually yes | Yes, they work alongside the testers | No, only a small group of stakeholders |
| Typical duration | Days to a few weeks, depending on scope | Short, focused working sessions | Weeks; Canary Trap’s typically run four to eight weeks end to end |
| Main deliverable | Severity-ranked findings with proof and remediation steps | Detection coverage results and tuned alerts | Attack narrative, timeline, detection and response gaps |
| What it measures | Exploitable vulnerabilities | Detection and alerting coverage | Detection, response and escalation under realistic pressure |
| Compliance fit | Required by PCI DSS (Req. 11.4); commonly expected for SOC 2 and ISO 27001 | Supports detection-maturity goals | Supports board, regulator and insurer assurance; required in some sectors (e.g., TIBER-EU) |
| Prerequisites | Defined scope | EDR or SIEM telemetry and an analyst to review alerts | A working SOC or MDR, an incident response plan and a pentest baseline |
| Relative cost | Generally the lowest of the three for a single scope | Depends on how many techniques and teams are involved | Generally the highest: a longer engagement with senior operators |
| Buy it first when | You’re starting out, have an audit coming or are launching something | A red team or incident showed your SOC missed things | You’ve fixed pentest findings and need to prove your defenses work |
Decision guide: which one should you buy first?
Work through these five questions in order and stop at the first one that sends you somewhere. Most organizations stop at question 1 or 2.
- Have you had a pentest of your critical systems in the last 12 months, and fixed the critical and high findings?
- No: buy a penetration test. A red team will walk through known holes and tell you what a pentest would have.
- Is an audit, customer security questionnaire or product launch due in the next 90 days?
- Yes: buy a penetration test scoped to that requirement. Auditors and customers ask for findings and remediation evidence, not attack narratives.
- Do you have EDR or a SIEM, plus someone responding to alerts around the clock (in-house SOC or MDR)?
- No: stay with penetration testing and invest in detection. There is no defensive capability yet for a red or purple team to measure.
- Do you know which attacker techniques your tools actually detect?
- No, or you’re not sure: buy a purple team exercise. It maps what you see and what you miss, and fixes detections as you go.
- You recently had a red team or a real incident that went undetected: also purple team first. Close the gaps before testing again.
- Is leadership asking whether an attacker could reach a specific asset, or do you face targeted threats or sector rules that call for adversary simulation?
- Yes: buy a red team exercise, scoped to that objective, ideally with a purple team replay at the end.
What mistakes do buyers make with their first purchase?
- Buying a red team to satisfy an auditor. The deliverable is a narrative, not the findings list most frameworks expect.
- Running a red team with no one watching. If nothing would raise an alert, “the red team wasn’t detected” isn’t new information.
- Treating purple team results as the finish line. Every missed technique needs an owner and a date, or the exercise was a demo.
- Comparing quotes on day rates alone. Ask who does the testing, how findings are validated and whether a retest is included.
Pentest vs red team for application security: which should you buy first?
For application security, buy an application penetration test first, almost without exception. Applications fail through broken access control, authentication flaws and business-logic abuse. Finding those takes systematic coverage of every role, endpoint and workflow, which is exactly what a pentest does and what a red team deliberately skips.
A red team takes the shortest path to its objective. If phishing a help-desk account gets there faster, your application may barely be touched. That’s useful for measuring detection, but it leaves an application’s attack surface largely untested.
An application pentest should cover:
- Authorization across every role, including IDOR and horizontal and vertical privilege escalation
- Authentication and session handling: login, MFA, password reset, token and JWT handling
- Business logic: pricing, workflow and rate-limit abuse that scanners can’t model
- APIs behind the UI, tested against the OWASP API Security Top 10
- A retest to confirm your fixes actually worked
When does a red team make sense for an application? When the app is the objective of a wider scenario, for example “can an outside attacker reach customer records in our SaaS platform?” By then the application should already have been pentested. The red team then tests whether your monitoring catches someone using it the way a real attacker would.
How much does each one cost?
Cost follows effort, and effort follows scope and duration. For a single scope, a pentest is generally the least expensive of the three and a red team the most, because it runs for weeks and needs senior operators. Purple team cost depends on how many techniques and teams are involved. Canary Trap scopes and quotes every engagement to your objectives.
What drives the price of each:
| Service | Main cost drivers |
|---|---|
| Penetration test | Number of applications, roles, API endpoints or IPs in scope; testing depth (black, grey or white box); whether a retest is included |
| Purple team exercise | Number of techniques tested; number of defensive tools and teams involved; whether it follows a red team as a replay |
| Red team exercise | Number and difficulty of objectives; attack vectors in scope (social engineering, physical, cloud); length of the operation; level of stakeholder coordination |
Fixed fee or per week? Fixed-fee quotes give budget certainty but depend on a tight scope. Per-week pricing flexes with the operation, which can suit red teams whose path isn’t known in advance. Either way, ask what happens if the objective is reached early or not at all.
What order should you buy them in over the next two years?
The three work best as a cycle, not a ladder you climb once. A typical sequence for a mid-size organization building toward adversary simulation:
- Penetration test of your highest-risk assets: external perimeter, customer-facing applications and APIs. Fix critical and high findings, then retest.
- Detection foundations. Make sure EDR covers your endpoints, logs reach a SIEM or MDR, and someone owns the response.
- Purple team exercise against the techniques most relevant to your threat model. Tune detections until the obvious paths raise alerts.
- Red team exercise with a clear objective. Measure time to detect, time to escalate and how far the attacker got.
- Purple team replay of the red team’s path, so defenders see every step and confirm the fixes.
- Keep pentesting at least annually and after significant changes, which PCI DSS requires and most auditors expect. Plan the next red team once the replay’s findings are closed.
Frequently asked questions
What’s the difference between a vulnerability assessment and a penetration test?
A vulnerability assessment identifies and ranks known weaknesses, largely with scanning tools. A penetration test goes further: testers try to exploit what they find, chain issues together and prove real impact. If you’ve never had either, a vulnerability assessment is a quick baseline. A pentest is what auditors and customers usually ask for.
Does a red team exercise satisfy SOC 2 or PCI DSS?
Not on its own. PCI DSS Requirement 11.4 calls for internal and external penetration testing at least every 12 months and after significant changes. SOC 2 and ISO 27001 auditors typically look for pentest findings and remediation evidence. A red team strengthens your assurance story but doesn’t replace the pentest.
How long does a full-scope red team take, and what are the phases?
Canary Trap’s red team exercises typically take four to eight weeks end to end, depending on objectives and scenario complexity. The phases are define (objectives and rules of engagement), operate (initial access through objective pursuit), report, improve and, where included, a purple team replay.
We already have EDR and a SIEM. How does a red team help?
It tests whether those tools are configured, tuned and watched well enough to catch a careful attacker. Typical findings are telemetry that never reaches the SIEM, alerts that fire but aren’t triaged, and escalation paths that stall outside business hours.
Can a red team run without disrupting operations or alarming staff?
Yes, if it’s scoped properly. Rules of engagement define off-limits systems, prohibited actions and a deconfliction contact who can confirm the activity is a test. Destructive actions are excluded unless explicitly approved. Leadership and legal are briefed before work starts.
Should we buy a one-off engagement or a retainer?
If you ship code weekly, a single annual pentest goes stale quickly. Testing new features as they land, through a retainer or pentest-as-a-service model, keeps coverage current. Red teams are usually run as periodic one-off engagements, timed around closing what the last one found.
How can you tell if a red team vendor is senior and not just running scanners?
Ask who will be on the engagement and what they’ve done before. Ask for a sample report. Ask how they handle OPSEC, deconfliction and out-of-scope discoveries. Ask whether a debrief or purple team replay is included. A senior team will answer specifically; a scanner shop will talk about tools.
Not sure where you are on this list?
A short scoping call is usually enough to tell which of the three answers your question today. Canary Trap runs all three, so the recommendation isn’t steered toward one service. Tell us what you need to prove and to whom, and we’ll work backwards from there.
