Red Team 101: How Pentests Differ from Real Adversarial Operations

Some clients buy a red team and expect a pentest report with 47 CVEs and a Nessus screenshot. Others buy a pentest and expect you to bypass the EDR, move laterally through Active Directory, and exfiltrate the HR database undetected for 30 days. Both are wrong, and our industry shares the blame for blurring the terms until they turned into marketing. Before you charge 80k per engagement, you need to know exactly what service you are selling, because the difference between the two reshapes the contract, the rules of engagement, the team, the tooling, and most importantly what actually lands on the table at the end. This guide draws the line technique by technique so you can scope honestly and deliver what the client truly needs.

A pentest is a coverage exercise

A pentest is a coverage exercise: given a finite scope (10 IPs, 3 web apps, one API), you enumerate vulnerabilities, validate exploitation when possible, and ship a report with CVSS severities, evidence, and remediation guidance. Success is measured in valid findings per hour, low false-positive rate, and remediation clarity. It looks like the work described in Web Pentesting From Scratch: Building a Safe Lab with DVWA, Juice Shop and Burp Suite and REST and GraphQL API Pentest: Technical Checklist for Legal Bug Bounty: methodical, repeatable, driven by checklists such as OWASP WSTG or PTES. You do not need to be invisible; you need to be thorough. A SQLi like the one in SQL Injection in Practice: Exploiting, Detecting and Mitigating in a Controlled Lab is worth the same as a stored XSS as long as both are exploited and documented.

Red team works the opposite axis

Red team works the opposite axis: objectives, not coverage. The client defines a crown jewel (access to the code-signing vault, exfiltration of the M&A spreadsheet, domain admin in the finance AD) and you get 4 to 12 weeks to reach it while emulating a specific adversary, usually a TTP set from MITRE ATT&CK seeded by threat intel. Surface scope is broad, often the whole company, but objective scope is narrow. You do not report 50 vulnerabilities; you report 3 end-to-end attack paths. Techniques like those in Adversary Emulation with Caldera and MITRE ATT&CK in a Corporate Lab, Lateral Movement in the Lab: SMB, WMI and WinRM with a Detection Focus and Active Directory Pentest: Step-by-Step Kerberoasting in a GOAD Lab come into play, and every action is weighed against detection risk. A red teamer who trips the SOC on day two has not failed; but a red teamer who never learns whether the SOC would have caught them has wasted the budget.

The vector difference: attack surface versus attack path

The clearest way to explain the split to a buyer is surface versus path. A pentest maps the attack surface: it wants breadth, so it fuzzes every parameter, tests every endpoint, and grades each weakness on its own merit. A red team walks an attack path: it wants depth, so it chains a phishing foothold to a credential, that credential to a share, that share to a service account, and that service account to the crown jewel. A single unpatched Confluence is a finding to a pentester and a doorway to a red teamer. The same CVE therefore gets written up completely differently: the pentest report says patch it and shows the request; the red team report says here is how we used it to reach domain admin and here are the four points where detection should have fired but did not.

Rules of engagement: where projects die

The ROE (Rules of Engagement) is where projects die. In pentests, the ROE usually fits in two pages: test windows, authorized IPs, emergency contacts, no DoS. In red team, the ROE becomes a 15-page document covering trusted agents (3 to 5 people in the know), stand-down procedures if the blue team starts a real incident response, phishing rules (who to send to, who not to, how to handle harvested credentials) as in Authorized Red Team Phishing: Templates, GoPhish and Ethical Guardrails, C2 limits (no implants on C-level workstations without written approval), and clauses about personal data. It must name a deconfliction channel so that when the SOC pages at 3 a.m. someone can confirm within minutes that the alert is you and not a genuine breach. Skip that, and you become the next Krebs headline for the wrong reasons, or worse, you watch a client trigger a real IR bridge against your own traffic.

Tooling and infrastructure diverge hard

Tooling reflects the goal. A pentest lives in Burp Suite, sqlmap, Nuclei, ffuf, Nmap with NSE, and a note-taking tool; the infrastructure is your laptop and a jump box. A red team needs disposable, attributable-only-to-you infrastructure: redirectors in front of the C2 so the real team server is never exposed, domain fronting or categorized domains to survive proxy inspection, and a C2 framework such as the one built in Building C2 Infra with Sliver in an Isolated Lab for Defensive Research. Payloads are crafted per host with attention to AMSI and ETW as studied in AMSI and ETW Bypass for Defensive Research: What Blue Teams Should Know, and initial access is engineered, not sprayed, using controlled techniques like those in Simulated Initial Access: Macros, LNK and ISO in an Isolated Windows 11 Lab. If you run a red team off a single VPS with a bare Cobalt or Sliver listener on the open internet, you are not emulating an APT, you are cosplaying one.

Team composition also diverges

Team composition also diverges. Pentest works well with 1-2 generalist operators plus the occasional specialist (mobile, AD, cloud). Red team demands roles: a C2 operator who owns infrastructure and session health, an initial access and phishing lead, an AD and lateral movement expert, someone running continuous reporting so the story is never reconstructed from memory at the end, and ideally a threat intel lead building the emulated adversary profile so the TTPs map to a real group the client actually fears. If you sell red team with the pentest org chart, you are selling slow pentest. Worse: you are billing red team and delivering a mediocre simulation that neither tests the SOC nor produces actionable purple team output like the loop described in Purple Team in Practice: Building a Red vs Blue Feedback Loop.

Ethical discipline matters more than technique

Ethical discipline matters more than technique, and this is not conference filler. It means concrete things: you do not try an AMSI bypass in production without lab repetitions first; you do not reuse C2 infrastructure across two clients without full rotation; you do not pick interns as initial access targets to inflate a click metric; you destroy harvested credentials at the end of the engagement and document the destruction; you never store a domain admin hash in a shared drive named loot. Operational OPSEC, as discussed in OPSEC for Security Researchers: Building a Personal Threat Model, protects both you and the client, because a leak of your artifacts turns into a real intrusion carried out by someone else using the map you drew. Your access is a loaded weapon held in trust, and the paperwork that authorizes it is the only thing between a legitimate engagement and a felony.

Common pitfalls when you mis-sell the engagement

The most expensive pitfall is scope drift born of the wrong sale. A client who bought a pentest but wanted red team will be disappointed that you reported 30 CVEs instead of proving their SOC is blind. A client who bought red team but wanted a pentest will be furious that you spent three weeks quietly reaching domain admin and left half the web apps untested. Other classic failures: promising stealth then flooding the network with Nmap on day one; promising coverage but rabbit-holing on a single objective; running a red team with no blue-team debrief so the client gets a scary PDF and zero improvement; and forgetting that some findings are so critical (an exposed domain admin credential in a public repo) that you must break the emulation and report immediately regardless of the assessment type.

Checklist: three questions before you sign

Practical takeaway: before you sign any engagement, ask the client three questions. One, what is the business goal (compliance, SOC validation, response drill, finding holes)? Two, what is the detection appetite (are we testing the path or the team)? Three, who are the trusted agents and who must NOT be informed? Then confirm the deliverable shape in writing: a pentest report is a prioritized list of findings with remediation; a red team report is a narrative of attack paths mapped to ATT&CK with detection gaps and blue-team recommendations. Nail down the stand-down procedure, the deconfliction contact, the data-handling rules, and the exact definition of the objective. If any of those four is fuzzy, do not start.

FAQ

Is a purple team just a red team with a talkative blue team? Not quite. A purple team runs the offensive TTPs collaboratively and in the open, side by side with defenders, optimizing for detection engineering rather than for stealth or objective completion. It is the fastest way to turn a red team's findings into durable rules, which is exactly why many mature programs alternate a covert red team with follow-up purple sessions. Can one report satisfy both audiences? Rarely and never well. Coverage and objective optimize for opposite things; a document that tries to be both usually buries the three attack paths that matter under 40 low-severity findings, or vice versa. Write the report the engagement type demands, and offer the other as a separate follow-on if the client wants both.

Conclusion

The distinction is not pedantry; it decides whether the client gets value or a bill. Sell a pentest when the answers point to compliance and coverage, and execute it with excellence: broad, documented, remediation-ready. Sell a red team when the answers point to validating detection and response against a realistic adversary, and back it with a solid ROE, proper infrastructure, a real team, and a purple-team debrief. Mixing the two under the same SOW is like billing for surgery and delivering a massage: someone walks out injured, usually your reputation. Get the sale right and the rest of the engagement becomes an act of craftsmanship instead of a fight over expectations.