Ruslan Rakhmetov, Security Vision
Senior executives, boards of directors, and investors are increasingly asking fundamental questions about the extent to which actual investments in cybersecurity protect company assets from targeted, well-funded attacks. Various audit methods are traditionally used to assess the effectiveness of established defenses, the most well-known of which are penetration testing and red teaming exercises (a deep simulation of a real attacker's actions). Although both approaches are aimed at identifying weaknesses in IT infrastructure, they differ radically in their goals, scale, methodology, duration, and, most importantly, the business value they provide. Therefore, in this review, we will compare these approaches and discuss Red Teaming, expanding on the previous overview of the concept, goals and tools.
а) The Origins of Red Team – Penetration Testing
b) Limitations and features of the approach
c) Features and goals of Red Teaming
d) Translation of results into business risk management
e) Automation of risk assessment and management
f) Maturity Matrix: When a company needs Pentesting and when Red Teaming?
The Origins of Red Team – Penetration Testing
Let's begin with the origins of pentesting, the practice of simulating malicious actions for protection. Penetration testing is a sanctioned, legitimate attempt to bypass the security elements of an information system with the goal of identifying the maximum number of vulnerabilities within a strictly specified timeframe. It focuses on the technological aspect of security: identifying outdated software, incorrect network equipment configurations, weak password policies, or fundamental flaws in the architecture of specific web applications and databases.
Imagine the owner of a large country house commissioning a penetration test of its security. A certified expert, hired, methodically walks the entire building, checklist in hand, around the perimeter and inside: he tries every doorknob, checks the security of the locks on all first- and second-floor windows, assesses the glass thickness, checks for holes in the fence, and verifies that the alarm light comes on when the front door is opened. After days of work, the owner receives a detailed, multi-page report: “The lock on the back door is rusted – high risk (equivalent to a critical IT vulnerability); the attic window doesn't close completely due to a warped frame – medium risk; and the hinges on the gate creak and could give away your presence – low risk.” The expert has diligently identified all potential entry points and compiled a comprehensive list of what needs to be repaired, replaced, or lubricated.
Limitations and features of the approach
Despite the obvious usefulness of such an audit, it has a number of limitations:
1) Penetration testing is always strictly scoped. Businesses, seeking to save time or fearing disruption to critical systems, often tell the tester, “Please test only our new corporate website and mobile app, but under no circumstances touch the internal accounting network, database servers, or attempt social engineering against our employees.”
2) In the vast majority of cases, pentesting the audit is conducted openly, or at least with the knowledge of the internal information security team. The defenders know for sure that the audit will be conducted between October 1 and 15. Their security systems are often configured in advance to exclude the testers' IP addresses from blocking lists (whitelisting), so that antivirus and intrusion prevention systems don't interfere with the auditors' work or block their scanners. This creates a completely artificial, hothouse environment, far removed from the harsh reality of cyberthreats.
3) A pentest fundamentally doesn't test the organization's response. The pentester's primary goal is to find a vulnerability, successfully exploit it (prove penetration is possible), and document this fact in a report. They don't aim to operate covertly, cover their tracks for months, or avoid detection. They're completely uninterested in how quickly the corporate security team notices an anomaly. Their only success metric is a comprehensive report listing vulnerabilities sorted by severity (e.g., according to the CVSS score).
Features and goals of Red Teaming
Red Teaming exercises, on the other hand, is designed to answer a fundamentally different, strategic business question: “Can our organization as a whole (combining technologies, established processes, and trained people) withstand, detect, and successfully neutralize a real, motivated, and highly skilled cyber group aimed at stealing or destroying our most critical business assets?”
Imagine you own a large jewelry store and want to truly test its security. Instead of hiring an inspector with a tablet to check every lock and sensor, you secretly, under a strict non-disclosure agreement, hire a team of professional “burglars” and give them a single, very specific goal (flag): “Steal a diamond necklace from the main safe in the basement, acting as discreetly as possible so our security guards won't suspect a thing.”
To these “hackers” (Red Team) is completely uninterested in, and there's no need to check every lock in a huge building. If they find even one working way in, they'll use it and forget about the other doors. They can spend weeks simply observing the store from a parked car across the street, studying the schedule of cash collectors and guard shift changes (this is the reconnaissance phase). They might notice that the senior security guard goes out to the backyard every day at precisely 2:15 PM for a smoke and leaves the heavy metal door ajar, propped against a brick. They can go even further: disguise themselves as bottled water delivery couriers, bring the bottles to the central office, and, while the secretary is distracted signing the invoice, discreetly plug a miniature device into the power outlet under her desk (this is a symbiosis of social engineering and physical penetration). They can even officially get a job as a janitor using forged documents.
Red Teaming tests the entire enterprise ecosystem. It's a rigorous stress test for people (will they fall for spear phishing?), physical security (will an outsider be able to get into the server room without passing the turnstiles?), and sophisticated technologies (will artificial intelligence systems detect abnormal user behavior on the network?). These exercises test a crucial parameter: the ability of the company's in-house information security team (Blue Team) detect deeply hidden threats, adequately and without panic assess incidents and promptly respond to them according to pre-approved plans.
Translation of results into business risk management
One of the main problems with traditional pentests is that technical reports with a dry list of compromised IP hosts, open ports, and CVE vulnerability identifiers are of little use to senior management and the board of directors. Businesses think and make decisions in completely different categories: categories of risks, likelihood of threat realization, and potential direct and indirect financial losses. This is why the results of Red's complex exercises Teaming should be seamlessly integrated into corporate risk management systems.
Information security analysts might, sitting in a conference room, theoretically assume that the probability of the threat “Compromise of a customer database through phishing” being realized is “Low” because the company has formally installed corporate spam filters, conducted training, and implemented organizational security measures.
The Red teachings Teaming shatters these theoretical illusions. If, during a simulated attack, Red Team effortlessly bypasses spam filters using a new method of concealing malicious code, successfully convinces a system administrator to give up a temporary password over the phone, moves through the network undetected by monitoring systems, and gains full access to the client base. This empirically and practically proves that the probability of this threat is not “Low,” but “Critical.”
Automation of risk assessment and management
The process of risk management in the field of information security is strictly formalized in such recognized international and national standards as ISO 27005:2022, GOST R ISO/IEC 27005, the methodology for assessing information security threats of the FSTEC of Russia, as well as in the analytical methodologies of FAIR (Factor Analysis of Information Risk), OCTAVE (Operationally Critical Threat, Asset, and Vulnerability Evaluation), FRAP and CRAMM.
To automate these complex processes, specialized solutions are used, such as the comprehensive Security Vision Risk Management (RM) is a product that enables the organization of a full risk management cycle for enterprises and organizations of all sizes and industries, ensuring the implementation of the process at all stages of its life cycle, starting from the stage of defining the environment.
A key feature of such systems is the resource-service model that underlies the product. It enables the creation of a digital enterprise model with any required level of decomposition, from high-level business processes and information systems to specific hosts, network equipment, or peripherals. Thanks to the visual representation in the form of a graph, analysts can trace all the complex relationships between objects to the required level of detail.
Maturity Matrix: When a company needs Pentesting and when Red Teaming?
A deep understanding of the conceptual differences between approaches allows the CEO and CISO to develop an optimal, financially sound investment strategy for practical cybersecurity. In our experience, the choice between pentesting and Red Teaming is not a matter of personal preference (“either-or”), but is determined solely by the current level of maturity of the organization’s IT infrastructure.
1. Building the foundation and basic hygiene
The company is just beginning to understand the importance of information security and develop the appropriate processes: the inventory process is being set up, basic information security tools (most often antiviruses and firewalls) are being installed. At this stage, it's not worth ordering expensive Red Cross training. Teaming is utterly pointless and a waste of budget, meaning a “burglar” will simply walk through a wide-open virtual door in five minutes, unopposed. At this stage, the company needs to focus on implementing Vulnerability Management and regularly use automatic Vulnerability Scanners to eliminate the most gaping holes.
2. Systematic verification and audit
The company has established and implemented processes for regular software updates, and centralized security information and environment management (SIEM) are beginning to accumulate logs and events. At this stage, regular penetration testing is vital for the business. External experts will help purge the infrastructure of obvious vulnerabilities, outdated versions of cryptographic protocols, and dangerous configuration errors that automatic scanners inevitably miss.
3. Proactive protection, monitoring and orchestration
The company operates a mature in-house or commercial (MSSP) SOC, has deployed deep automation platforms (IRP/SOAR), AI-based behavioral analytics systems (UEBA), and has implemented systems for collecting and analyzing data on global cyber threats – Threat Intelligence Platform, automated incident response scenarios are configured and debugged. The company professionally manages operational and cyber risks (ORM, RM) using resource-service models. It is here, at the peak of technological maturity, that the time comes to conduct Red Teaming exercises.
This allows executives to more intelligently allocate IT investment budgets, selectively optimize security resources, and ultimately ensure the continuity and financial sustainability of business processes in the face of a rapidly evolving global cyberthreat landscape.
.jpg)
.png)
