The short version of penetration testing vs red teaming: a penetration test looks for weaknesses in a system, and a red team engagement tests whether your people and tooling would notice an attacker working towards an objective. The NCSC’s Cyber Adversary Simulation scheme is a third option, and it assures the provider rather than describing the test.
Buy a penetration test when you need to know what is broken. Buy a red team when you need to know whether you would spot it. Consider CyAS when you already have monitoring and incident response worth testing, which the NCSC states plainly is a prerequisite rather than an outcome.
The NCSC says a CyAS engagement may be appropriate once you “have mature preventative and detective security controls”, “operate security monitoring capabilities” and “have established incident response processes”. It may not be the right starting point if you “have limited monitoring or detection capability” or are “still implementing foundational cyber security controls”.
What Each Test Actually Tells You
Most confusion about penetration testing vs red teaming comes from treating them as different sizes of the same exercise. They answer different questions, and the third option answers a question about the supplier rather than about you.
| Test | What it answers | What you get |
|---|---|---|
| Penetration test | Where is this system weak? | A findings list with severities, against a scope you defined |
| Red team engagement | Would we notice somebody working towards an objective? | A narrative of what was achieved, what was detected, and when |
| CyAS engagement | Can we prevent, detect and respond to a realistic attack? | The same kind of answer, from a provider assessed against the NCSC’s methodology |
The practical difference is what a bad result means. A penetration test that finds plenty is a productive test. A red team engagement where nobody noticed anything is not a productive test, it is a finding about your monitoring.
What CyAS Is, and What It Actually Assures
CyAS is the NCSC’s Cyber Adversary Simulation scheme. The NCSC describes its purpose in its own introduction to the scheme as helping organisations “find NCSC-assured providers”, with approved providers assessed against the methodology in the scheme Standard. The engagements themselves “test their ability to prevent, detect and respond to realistic cyber attacks”, which the NCSC calls “a realistic test of an organisation’s cyber resilience”.
Two things are worth being precise about. First, the scheme assures the provider, not the test. It tells you a supplier has been assessed as capable; it does not change what the engagement is. Second, it is new, and the NCSC says so: the scheme is “currently operating as a Minimum Viable Product (MVP)”, a phase expected to last around 18 months while feedback is gathered and the scheme refined.
The NCSC published the first scheme documents, the Scheme Standard and the Working Practices Document, in September 2026, and said the scheme formally launches in November 2026. It also draws its own distinction with what came before: “In contrast to some similar standard industry schemes, our CyAS approach is capability-led”, with providers not expected to replay a fixed script of known attacker behaviours.
Who it is aimed at is equally explicit. The NCSC targets organisations that “understand their key business functions and services”, and says the scheme is especially valuable for large organisations, critical national infrastructure operators and government bodies.
Not sure which test you need?
Talk to the Transputec team about the security work behind our Penetration Testing and Managed SOC.
Get in TouchThe NCSC's Own Readiness Bar for CyAS
This is the part worth reading before anybody books anything. The NCSC’s guidance for buyers publishes two lists, and they are unusually direct for government guidance.
A CyAS engagement may be appropriate once you understand your key business services and cyber risks, have mature preventative and detective security controls, operate security monitoring capabilities, have established incident response processes, and want to validate your ability to respond to realistic cyber attacks.
It may not be the right starting point if you have not identified your critical assets or services, have limited monitoring or detection capability, are still implementing foundational cyber security controls, or need to establish a baseline understanding of cyber risk.
Read the second list as a diagnostic. If two or more of those describe you, the honest answer is that an adversary simulation would produce a report nobody can act on, because the gap it finds will be the absence of the capability it was supposed to test. That is an expensive way to learn something a vulnerability assessment would have told you in a fortnight.
Where a Penetration Test Is Still the Right Buy
More often than the industry’s enthusiasm for adversary simulation suggests. In the penetration testing vs red teaming decision, the test wins whenever the question is factual rather than behavioural.
- You have shipped something new. A web application, an external service, a cloud migration. You want to know what is exposed before somebody else finds out.
- Somebody has asked for evidence. An insurer, a customer security questionnaire, a certification scope. They want a findings report with dates against it, not a narrative.
- You need a baseline. If you cannot currently say which of your internet-facing assets carry known vulnerabilities, that is the first gap to close.
- Your estate changed shape. After an acquisition, an office move or a major platform change, the scope you last tested is not the scope you now run.
Transputec runs penetration testing with OSCP-certified testers across external, internal, web application, cloud and red-team engagements, scoped against your risk register rather than sold as a fixed package.
Where Red Teaming Fits
A red team engagement is worth buying when you believe your defences work and want that belief tested. The difference from a penetration test is not difficulty, it is what is under examination: a red team tests your detection and response, with your systems as the terrain rather than the target.
Which means the prerequisites are about you, not the supplier. Somebody has to be watching, during and outside working hours. Somebody has to have the authority to act on what they see. And somebody has to be willing to read a report saying an operator spent three weeks inside the estate and nobody raised a ticket.
That last point is why these engagements sometimes go badly as projects even when they go well as tests. Agree in advance who sees the findings and what happens next, because the output is a story about your team’s performance rather than a list of software flaws. Handled properly it is the most useful security spend available. Handled as a compliance exercise it produces a document nobody circulates.
How to Choose Between Them
Three questions settle most cases of penetration testing vs red teaming, and all three are about your situation rather than the test.
- Do you already know what is broken? If not, you are buying a penetration test, whatever the board has been reading about adversary simulation.
- Would anyone notice an intruder today? If you cannot answer that with evidence out of your monitoring, a red team will tell you no, expensively. Fix the monitoring, then test it.
- Who is asking, and what will they accept? A regulator, insurer or customer usually wants a findings report against a defined scope. An internal sponsor asking whether you are actually ready wants the behavioural answer.
Sector requirements matter on the third point. The NCSC tells CyAS buyers to “carry out your own commercial and procurement due diligence when selecting a provider” and to “check whether your sector has any additional requirements”. Government buyers can use the Government Commercial Agency’s Dynamic Purchasing System, while the NCSC says organisations in other sectors “should use their normal procurement route, process or framework”.
What Buying the Wrong One Costs
Rarely the fee. The cost is the year you spend believing a question has been answered when it has not.
- A red team bought too early returns a finding you already suspected, with no detail on which vulnerabilities to close. The report is accurate and unusable.
- A penetration test bought as assurance tells you the scope you defined was tested. It says nothing about whether anyone would notice the same activity in production.
- An adversary simulation with no response capability behind it becomes a document rather than an exercise, because there is nothing to exercise.
- A test scoped to pass is the quiet one. If the scope excludes the awkward legacy system, a clean result describes the scope rather than the estate.
Guard against the last one explicitly. Ask any supplier what they would exclude and why, and treat a scope that avoids your worst-maintained system as a finding in itself.
What to Build Before You Book an Adversary Simulation
Read the NCSC’s “not the right starting point” list a different way and it becomes a build order. Each item has a concrete first step.
- Identify critical assets and services. Name the handful of services the business genuinely cannot lose, and what each one depends on.
- Get detection coverage. Logs from endpoint, identity, network and cloud in one place, watched outside working hours rather than reviewed on Monday morning.
- Close the foundational controls. Patch windows set by asset criticality, multi-factor authentication on every administrative path, and known vulnerabilities tracked rather than rediscovered.
- Write the incident response process down. Who decides, who can disable an account, and what the reporting thresholds are.
- Then test it. At that point a red team or a CyAS engagement is measuring something real.
None of that is exotic, and most of it is the ordinary work of running security properly. The NCSC 10 Steps to Cyber Security covers the same ground as a framework. It is also why the readiness bar is the most useful thing the NCSC has published about the scheme: it tells you what good looks like before anybody sells you a simulation of an attacker.
How Transputec Fits
A straight answer on penetration testing vs red teaming, and on where we sit, because a soft one is no use to a buyer.
Transputec delivers two of these three. Our cyber security services include penetration testing with OSCP-certified testers, across external, internal, web application, cloud and red-team engagements scoped to your risk register. Analysts in our London SOC are OSCP-credentialled, and our managed SOC practice aligns with the NCSC 10 Steps to Cyber Security.
Transputec is not an NCSC-assured CyAS provider. If you have cleared the readiness bar above and specifically want a CyAS engagement, the scheme exists precisely so you can find an assured supplier, and you should use it.
Where we are useful is where most organisations actually are: building the monitoring, detection and incident response that the readiness bar describes, through Managed SOC, Managed Detection and Response and Cyber Incident Response. Talk to our team about the security work behind our Managed SOC if the honest answer to “would we notice” is currently no.
Frequently Asked Questions
What is the difference between penetration testing vs red teaming?
Scope and purpose. A penetration test examines a defined system and reports the weaknesses it finds, so the output is a findings list with severities. A red team engagement works towards an objective and reports what it achieved and what you detected, so the output is a narrative about your monitoring and response. Put simply, penetration testing vs red teaming is the difference between asking what is broken and asking whether you would notice someone exploiting it.
What is the NCSC CyAS scheme?
Cyber Adversary Simulation is an NCSC scheme that assures providers of adversary simulation engagements. The NCSC describes its purpose as helping organisations find NCSC-assured providers, with approved suppliers assessed against the methodology in its scheme Standard. The engagements test an organisation’s ability to prevent, detect and respond to realistic cyber attacks. The NCSC published the first scheme documents in September 2026 and said the scheme formally launches in November 2026, and it is currently operating as a Minimum Viable Product expected to run for around 18 months.
Do we have to use a CyAS-assured provider?
Not unless your sector requires it. The scheme is a way to find a supplier the NCSC has assessed, not a legal obligation, and the NCSC tells buyers to carry out their own commercial and procurement due diligence anyway and to check whether their sector adds requirements. Government buyers can use the Government Commercial Agency’s Dynamic Purchasing System; other sectors are told to use their normal procurement route.
How mature do we need to be before a red team is worth buying?
Mature enough that the result will tell you something you cannot already work out. The NCSC’s own bar for adversary simulation is mature preventative and detective controls, security monitoring in operation, and established incident response processes. If you have limited monitoring, are still implementing foundational controls, or have not identified your critical services, a red team will report that nobody noticed, which you could have predicted without paying for it.
Is a penetration test enough for an insurer or a customer questionnaire?
Usually yes. Insurers, customer security questionnaires and certification bodies generally want a findings report against a defined scope, with dates and remediation status, which is exactly what a penetration test produces. Where a questionnaire asks specifically about detection and response capability, a test report will not answer it, and that is the point at which a red team engagement becomes the relevant evidence.
This article was drafted with AI assistance and reviewed by the Transputec team. Featured image: AI-generated.
