A Penetration test, colloquially known as a pen test, is an authorized simulated attack on a computer system, performed to evaluate the security of the system. The test is performed to identify both weaknesses (also referred to as vulnerabilities), including the potential for unauthorized parties to gain access to the system’s features and data, as well as strengths, enabling a full risk assessment to be completed.

The process typically identifies the target systems and a particular goal—then reviews available information and undertakes various means to attain the goal. A penetration test target may be a white box (which provides background and system information) or black box (which provides only basic or no information except the company name). A penetration test can help determine whether a system is vulnerable to attack if the defenses were sufficient, and which defenses (if any) the test defeated.

A Red team is a group of white-hat hackers that attack an organization’s digital infrastructure as an attacker would in order to test the organization’s defenses.  The use of cyber red teams provides “real-world attack simulations designed to assess and significantly improve the effectiveness of an entire information security program.

According to Peter Kim, Author of The Hacker Playbook 3, Penetration test usually have a restrictive scope and time limit (1-2 weeks). They are also usually announced. Whereas Red Teams usually have no pre-defined playbook and the engagements can take from 1 week to 6 months and are not usually announced.

Pentest simply point out vulnerabilities where Red Teams work like a real adversary would in gaining a foothold in your environment while trying to remain undetected and testing the posture of your security program.