Organisations often ask for 'a pentest' when they actually need something different, or they pay for an advanced exercise before the basics are in place. The three terms describe different activities with different goals, costs and outputs. Choosing correctly saves money and produces findings you can act on.
Three tests, three questions
- Vulnerability assessment: which known weaknesses exist across our estate? It relies mainly on automated scanning, validated by an analyst, and gives broad coverage with a prioritised list.
- Penetration test: can a skilled tester exploit weaknesses in this defined scope, and how far can they get? It is manual and time-boxed, and focuses on a specific target such as a web application, a network segment, a mobile app or a wireless network.
- Red team exercise: can our people, processes and detection stop a realistic adversary pursuing a specific objective? It is goal-based and usually covert, emulates real threat actor behaviour (often mapped to MITRE ATT&CK), and tests the defenders as much as the technology.
Match the test to your maturity
If you do not yet have a reliable asset inventory and a patching routine, start with vulnerability assessments. A penetration test on an unpatched estate mostly rediscovers problems a scanner would have found for less money. Once the basics are under control, penetration tests on critical systems, such as internet-facing applications, payment platforms and core banking interfaces, show whether the weaknesses can be chained into real impact.
Red teaming makes sense only when you have monitoring and an incident response process to test. Without a SOC or a tested playbook, the outcome is simply 'they got in', which you probably already assumed.
Scope and rules of engagement
A good test is defined before it starts. Agree in writing:
- Formal authorisation from the system owner, including third-party hosts and cloud providers where their approval is required.
- What is in scope, what is explicitly out of scope, and the testing windows.
- The knowledge level: black box (no information), grey box (user-level access) or white box (documentation and source code).
- Safety rules for production systems, recent backups, emergency contacts and conditions for stopping the test.
- How evidence and any data touched will be handled, stored and destroyed.
- The methodology, for example the OWASP Testing Guide and ASVS for applications, and NIST SP 800-115 as a general reference for technical security testing.
Cadence
There is no universal schedule, but a sensible pattern is continuous or monthly vulnerability scanning for internet-facing and critical assets, a penetration test at least annually and after major changes or before a new system goes live, and a red team exercise every one to two years once detection is mature. Some frameworks are explicit: PCI DSS v4.0.1 requires internal and external vulnerability scans at least quarterly, and penetration testing at least annually and after significant changes.
Reporting that drives action
The report is the product. Ask for an executive summary that a board member can read in five minutes, findings rated by risk with evidence and reproduction steps, clear remediation guidance, and an attack narrative showing how individual weaknesses combined. Severity scores such as CVSS are a starting point; context, such as whether the system holds customer data or supports a payment flow, should adjust priority.
Remediation and retest
A test without follow-through is only a document. Assign every finding an owner and a deadline based on severity, track progress in one register, and schedule a retest to verify that fixes actually work. Report closure rates to management, because an open critical finding is a risk the organisation has knowingly accepted unless someone decides otherwise.
How Wethaq ICT helps
Wethaq ICT helps you decide which test fits your current maturity and risk, defines scope and rules of engagement with your teams, and delivers clear reports with practical remediation guidance. We then support remediation tracking and retesting so that findings are closed, not just recorded.
Let’s build a secure foundation for your digital future
It starts with a free consultation: we learn your challenges and goals, then propose a service package tailored to your needs and budget.