In late 2024, CISA published findings from a red team assessment of a US critical infrastructure organisation with a mature security posture. The organisation passed its penetration tests. The red team gained persistent access, moved laterally across geographically separated sites, and remained undetected throughout the entire assessment. The defenders never noticed.
That disclosure is the clearest available illustration of why the question ANZ CISOs should be asking is not "red team or penetration test" but "which one does my organisation have the readiness to act on right now?"
The answer requires understanding what each exercise actually measures, and what each requires the organisation to bring to the engagement to produce useful output.
What Each Exercise Measures
A penetration test is scoped and breadth-first. Penetration testing finds and reports exploitable vulnerabilities in an agreed target, in days to weeks. The scope is defined before engagement. The tester works within it. The output is a finding list: vulnerabilities confirmed as exploitable, ranked by severity, with reproduction steps and remediation guidance.
A penetration test measures the vulnerability density of the tested environment. It answers: what is broken that an attacker could exploit? It does not test whether the organisation would detect or respond to an attacker who found and used that break.
Red teaming is objective-based and stealthy. It emulates a real adversary against people, processes, and technology to test whether you detect and respond, over several weeks to months. The red team works toward a defined objective, such as reaching the chief executive's inbox or exfiltrating specific data, using whatever techniques allow them to progress undetected. The output is an attacker narrative: here is how we got in, here is how we moved, here is how long we remained, and here is what your team saw at each stage.
A red team exercise measures detection and response readiness. It answers: if a competent attacker used our known vulnerability profile against us, would we catch them before they reached the objective?
The Readiness Prerequisites for a Red Team Exercise
This is the question most ANZ organisations should answer before they allocate budget to a red team engagement.
The first prerequisite is a cleared vulnerability backlog. Penetration testing should come first and should continue annually regardless. It is required for compliance and produces vulnerability coverage that red teaming does not replace. A red team exercise conducted against an environment with unpatched critical and high-severity findings from the last penetration test will exploit those findings first. The resulting report will describe how an attacker moved through known, unpatched vulnerabilities. That output does not test detection readiness. It tests remediation lag.
The second prerequisite is a mature detection stack. A red team exercise tests whether your people and tools detect a real attacker. If your SIEM is not tuned, your endpoint detection coverage is incomplete, or your SOC does not have defined playbooks for the alert types the red team will generate, the exercise will confirm that an undetected attacker remained undetected. The finding is real. It is also not specific enough to be directly actionable without the detection maturity to produce it.
For APRA-regulated entities, APRA CPS 234's requirement for systematic control testing calibrated to threat exposure implies that penetration testing remains the evidence mechanism for control validation, while red team exercises test the controls that sit above individual vulnerability findings: the detection, escalation, and response processes that determine organisational resilience. Both are needed. The sequence matters. For how testing evidence connects to the compliance programme that APRA and ISO 27001 auditors expect, the guide to continuous penetration testing for SOC 2 and ISO 27001 compliance covers the evidence structure that testing programmes build over time.
AUD Cost Ranges and Compliance Mapping
Typical Australian penetration testing pricing runs from AUD $6,000 for a small web application to AUD $60,000 for red team engagements. More specifically: standard web application and network penetration testing sits between AUD $8,000 and AUD $30,000 for most mid-market engagements. Red team exercises typically cost USD $50,000 to $200,000 or more, depending on organisational size and complexity. At AUD exchange rates in 2026, this places most ANZ red team engagements between AUD $75,000 and AUD $200,000 for a full-scope exercise.
APRA CPS 234 and ISO 27001 both accept penetration testing as the compliance evidence mechanism for security control validation. Neither framework specifically mandates red team exercises, though red team findings can contribute to the risk management programme evidence under APRA CPS 230 and to the control effectiveness evidence under ISO 27001 clause A.12.6.
For government entities and IRAP-assessed environments, the ASD IRAP process is a separate assessment pathway that covers governance and control documentation. Red team exercises and IRAP assessments test different things and neither substitutes for the other.
The Essential Eight does not require red team exercises. At Maturity Level 3, the detection and response capabilities that a red team exercise tests become relevant, but the mechanism for evidencing them in the Essential Eight context is adversarial testing of detection controls, not a full red team engagement in the traditional sense.
What happens after a penetration test finds critical vulnerabilities is covered in the guide to what happens after a penetration test. That remediation and re-testing cycle is the prerequisite that should be completed before a red team exercise is commissioned.
The Decision Framework for ANZ CISOs
Organisations test only 32% of their attack surface in a given year, even though 95% rank penetration testing as a top priority. That gap makes the sequencing question more urgent than the modality question for most ANZ organisations.
Commission a penetration test if:
You have not completed an annual engagement in the last twelve months, you have unpatched findings from a prior engagement, you have launched a new product or major infrastructure change since the last test, or you need compliance evidence for APRA, SOC 2, ISO 27001, or Essential Eight purposes.
Commission a red team exercise if:
You have completed at least two to three rounds of penetration testing with confirmed remediation, your detection and response stack is mature and monitored, and you need to test whether your team would detect a skilled attacker operating against your specific threat model, not just identify additional vulnerabilities.
Both running simultaneously suits large APRA-regulated entities and critical infrastructure operators who need compliance evidence from structured penetration testing while separately testing detection and response maturity through adversarial simulation.
Book a scoping consultation to confirm which engagement produces the most actionable output for your current ANZ compliance requirements and security maturity level.
Book a Scoping ConsultationPlan Your Annual Pentesting Strategy the Right Way
Learn how modern SaaS companies structure pentesting across the year to reduce risk, stay compliant, and avoid last-minute panic before audits.
Your Last Pentest Is Already Out of Date
Every week you ship without continuous testing is a week a vulnerability goes unseen. See what Capture The Bug finds in your first engagement.
Frequently Asked Questions
Q1: What is the fundamental difference between red teaming and penetration testing?
A: A penetration test is scoped and breadth-first. It finds and reports exploitable vulnerabilities in a defined target environment, typically over days to weeks. The output is a finding list with reproduction steps and remediation guidance. A red team exercise is objective-based and stealthy. It emulates a real adversary working toward a specific goal, such as reaching sensitive systems or exfiltrating data, and measures whether the organisation's people, processes, and detection tools would catch and stop them. Penetration testing measures vulnerability density. Red teaming measures detection and response readiness.
Q2: When should an ANZ organisation commission a red team exercise instead of a penetration test?
A: A red team exercise is appropriate when: at least two to three rounds of penetration testing have been completed with confirmed remediation, the detection and response stack is mature and actively monitored, and the organisation needs to test whether its team would detect a skilled attacker, not just find additional vulnerabilities. If unpatched findings remain from prior penetration tests, or if detection coverage is limited, the output of a red team exercise will confirm known weaknesses rather than test response maturity.
Q3: How much does a red team exercise cost in Australia in 2026?
A: A full-scope red team engagement in Australia typically ranges from AUD $75,000 to AUD $200,000, depending on the organisation's size, complexity, and the exercise's objective and duration. Standard penetration testing ranges from AUD $8,000 to AUD $30,000 for mid-market web application and network engagements. The cost difference reflects the duration (several weeks to months for red team vs days to weeks for penetration testing), the methodology (covert adversary emulation vs scoped vulnerability testing), and the provider specialisation required.
Q4: Does APRA CPS 234 require red team testing for Australian financial institutions?
A: APRA CPS 234 requires systematic security control testing calibrated to threat exposure, and penetration testing is the established compliance evidence mechanism for control validation. CPS 234 does not specifically mandate red team exercises. Red team findings can contribute to risk management programme evidence under APRA CPS 230 and may be relevant to larger APRA-regulated entities with mature security programmes. For most APRA-regulated entities, penetration testing remains the primary compliance testing mechanism.
Q5: What readiness should an ANZ organisation have before commissioning a red team exercise?
A: An organisation should have completed at least two to three rounds of penetration testing with confirmed remediation of critical and high-severity findings. Without this, a red team exercise will exploit known unpatched vulnerabilities rather than testing detection readiness, which produces a report describing remediation lag rather than response maturity. The detection and response stack should be mature and actively monitored, with defined playbooks for the alert types the red team will generate. An organisation without these prerequisites will get more actionable output from additional penetration testing than from a red team exercise.
