Red Teaming vs. Penetration Testing: What SMEs Actually Need
The short answer
The pentest finds the gaps. Red teaming shows what an attacker does with them.
- Penetration test: a defined scope is tested systematically. The result is a rated list of vulnerabilities. It answers the question "What is vulnerable?".
- Red teaming: an attacker pursues one concrete goal and takes whatever path works. It answers "How far does someone get — and does anyone notice?".
- For most SMEs, the pentest comes first. Red teaming pays off once the obvious gaps are closed, or when you want to test your detection.
- An affordable middle ground: a small external red teaming starter as a first look from the outside, at a fixed price.
Two tests, two questions
"Red teaming" sounds like the more thorough, more serious test, so it is tempting to go straight for it. The honest answer: it is not the more thorough test, it is a different one. It answers a different question.
A pentest is like an inspection: someone walks through the house room by room and notes every open window. Red teaming is like a break-in attempt: someone wants to get to the safe, takes the first window that opens and watches whether the alarm goes off. Both are useful. But if the house has never been inspected, the break-in attempt mostly tells you that the first window was open.
The comparison at a glance
| Penetration test | Red teaming | |
|---|---|---|
| Key question | What vulnerabilities does this system have? | Can an attacker reach a specific goal — and does anyone notice? |
| Approach | Coverage-driven: the agreed scope is worked through systematically, including logged-in areas and roles | Goal-driven: one attack path is followed until the goal is reached or not |
| Who knows | IT and operations usually know about the test | Often only a small circle, so you see whether detection and response work |
| Result | List of findings with severity, reproduction steps and recommendations, plus a retest | The attack path to the goal, the gaps along the way and — in a detection exercise — what was detected and what was not |
| Duration | A few days to a few weeks, depending on scope | From a compact starter (report in 10 working days) to campaigns lasting several weeks |
| Cost with us | From €3,500, fixed price after scoping | Starter €2,500 fixed price; assumed breach, purple teaming and campaigns after scoping |
| Fits when … | … you need evidence, a new application goes live or you have never been tested | … pentests hardly find anything new or you want to know whether an attack would be noticed |
When a penetration test is the right step
You have never been tested, or the last test was years ago
This is the most common case. Since the last test, new releases, interfaces and service providers have been added. A pentest shows today's state in full; red teaming only shows the one path the attacker takes.
A customer, auditor or law requires evidence
For ISO 27001, TISAX, customer audits or evidence of effectiveness under NIS2, what counts is a dated report with scope, findings and retest. More in our article on NIS2 evidence.
A new application or API goes live
Here you want every role, every logged-in area and every interface tested. Only a coverage-driven test does that.
What a pentest costs and what drives the price is covered in our overview Penetration test cost 2026. You can see the price for your scope upfront in the pentest calculator.
When red teaming pays off
Your pentests hardly find anything new
Once the individual systems are clean, the next question is whether small weaknesses, each harmless on its own, can be chained into an attack path.
You have monitoring and want to know whether it fires
Red teaming with detection measurement matches every attack step against your logs and alerts. Afterwards you know what was detected, what was not and why.
Management wants to see the real thing
A list of findings rarely convinces a board. A traceable path from the internet to the customer data does.
The middle ground: a red teaming starter
Classic red teaming is too big for many SMEs. That is why we offer a deliberately small entry point: an external attack at a fixed price, with one concrete question instead of "please check our security".
What is included
- Attack from the outside, without credentials
- One domain, up to five systems, one public application, one attack goal
- Security expert supported by AI, every finding verified by hand
- Report with an action list within 10 working days, 60-minute results meeting
- Second expert review, sign-off by the German security lead
- €2,500 fixed price, optional retest €300
What is not included
- Internal attacks and assumed breach (on request)
- Logged-in areas, user roles, tenant separation
- Phishing and social engineering (on request)
- Measuring your detection with log access (on request)
- Destructive tests, denial of service, bulk data download
The starter does not replace a pentest. What it finds is often the reason to test individual systems more thoroughly in a pentest afterwards. Details on the red teaming page.
What we do not offer
No TLPT under TIBER-DE or DORA. Threat-led penetration testing is aimed at a small group of designated financial institutions, requires testers who meet strict regulatory requirements, and at least twelve weeks of testing. If your supervisor requires TLPT, you need a different provider. We offer TIBER-inspired scenarios for SMEs and say openly that they are not a regulator-recognised TLPT.
We also do not run a 24/7 SOC or incident response. Red teaming shows you whether your detection works; we do not operate that detection for you.
The sensible order
Security is not a single test but a cycle. We call it the Security Cycle:
- 1
See
Continuously watch what is reachable from the outside. The free attack surface check is the entry point; monitoring starts at €249 per month.
Attack surface monitoring - 2
Test
Have your most important systems tested systematically in a penetration test, from €3,500.
Penetration testing - 3
Attack
Use red teaming to test whether an attacker reaches their goal and whether you notice. The starter costs €2,500.
Red teaming - 4
Frequently asked questions about red teaming and pentests
What is the difference between red teaming and a penetration test?
A penetration test looks for as many vulnerabilities as possible within a defined scope and rates them. Red teaming pursues one concrete attack goal, like a real attacker, and also checks whether the attack is noticed. The pentest answers "What is vulnerable?", red teaming "How far does an attacker get, and does anyone see them?".
Do we need a pentest or red teaming first?
For most companies, the pentest first. Red teaming assumes the obvious gaps are closed; otherwise it only confirms, at a higher price, what a pentest would have found more cheaply. The exception is a small external red teaming starter as a first look from the outside.
How much does red teaming cost?
It depends heavily on scope. Our red teaming starter costs €2,500 at a fixed price (one domain, up to five systems, one attack goal, report in 10 working days), an optional retest €300. Assumed breach, purple teaming and multi-week campaigns are priced after a scoping call.
Is a red teaming starter enough as NIS2 evidence?
It shows from the outside whether your measures work, but deliberately covers only a small surface. As evidence of effectiveness under NIS2 (in Germany § 30(2) no. 6 BSIG), a penetration test of your most important systems is the stronger basis. The starter complements it. This article is not legal advice.
Do you offer TLPT under TIBER-DE or DORA?
No. Threat-led penetration testing under TIBER-DE or DORA is aimed at a small group of designated financial institutions, requires testers who meet strict regulatory requirements, and at least twelve weeks of testing. For that you need a different provider.
Not sure which test fits?
In a 30-minute call we assess where you stand and tell you honestly whether a pentest, a red teaming starter or the free attack surface check is the right next step.
