Red teaming vs penetration testing
A pentest tries to break a defined system's security features. A red team emulates an adversary against an organization. AI red teaming also covers harmful output.
A penetration test tries to break the security features of a defined system. A red team exercise emulates an adversary against the whole organization and tests how well its defenders cope. In AI, “red teaming” has a third, wider meaning that also covers harmful output.
What NIST says each one is
NIST’s glossary gives several definitions of penetration testing. They agree on the core. Assessors “attempt to circumvent or defeat the security features of a system” (SP 800-53 Rev. 5), and in SP 800-115 the tests “mimic real-world attacks in an attempt to identify ways to circumvent the security features.”
A red team is “a group of people authorized and organized to emulate a potential adversary’s attack or exploitation capabilities” against an organization’s security posture. It shows the effects of a successful attack and shows defenders (the blue team) what works (NIST glossary).
The clearest statement of how they relate is in NIST SP 800-53 Rev. 5, control CA-8(2). Its discussion says red team exercises “extend the objectives of penetration testing” by assessing an organization’s security and privacy posture and its ability to implement effective cyber defenses. The same text says penetration testing may be mainly laboratory-based, while red team exercises can give more comprehensive assessments that reflect real-world conditions.
Side by side
| Penetration test | Red team exercise | AI red teaming | |
|---|---|---|---|
| Aim | Find ways to circumvent a system’s security features (NIST) | Emulate an adversary and show what works for defenders (NIST) | Find flaws in an AI system, including security holes and harmful output (Microsoft) |
| What is assessed | System security features | Security posture and ability to implement effective cyber defenses (NIST CA-8(2)) | The model, the application, and in the OWASP guide also infrastructure and runtime behavior (OWASP) |
| Attack types | Attempts to circumvent or defeat security features (NIST) | Technology-based and social engineering-based (NIST CA-8(2)) | Old and new cyberattack vectors (Microsoft), plus harm from ordinary use |
| Who tests | Assessors, often under set constraints (NIST) | Most effective with testers who know current adversary tactics, techniques, procedures and tools (NIST CA-8(2)) | Both adversarial and benign mindsets, including ordinary users (Microsoft) |
Where AI changes the meaning
Microsoft’s guide says red teaming “has historically described systematic adversarial attacks for testing security vulnerabilities” and that, with large language models, the term “has extended beyond traditional cybersecurity.” It adds that “both benign and adversarial usage can produce potentially harmful outputs.”
That is the main reason a security pentest does not cover an AI feature. A pentester looks for a person defeating a control. An AI red teamer also looks for a normal user getting harmful content from a normal prompt.
The security side still matters. Microsoft’s team, after red teaming more than 100 generative AI products, says AI red teams should watch for “cyberattack vectors both old and new” (Microsoft Security blog). Prompt injection is one AI-specific vector. The full definition of the AI practice is in AI red teaming.
Related term: vulnerability assessment
NIST defines a vulnerability assessment as a “systematic examination of an information system or product to determine the adequacy of security measures” and to identify security deficiencies (NIST glossary). It is an examination, not an attempt to circumvent controls, which is how the glossary describes penetration testing.
Which to choose
| Your question | Fits best |
|---|---|
| Can someone get past the security features of this system? | Penetration test |
| Would our people and processes notice and handle a realistic adversary, including social engineering? | Red team exercise |
| Does our AI feature leak data, follow injected instructions or produce harmful output? | AI red teaming, with security testers and ordinary users |
The categories overlap. Treat the table as a starting point for scoping, not a rule, and write the scope and rules of engagement down before testing. NIST’s control text itself calls for exercises run “in accordance with applicable rules of engagement” (NIST CA-8(2)).
What none of them replace
Microsoft says red teaming “is not a replacement for systematic measurement”: it identifies harms and the risk surface, and a specific example should not be read as a metric for how common a harm is. For measurement see LLM evaluation, and for runtime defenses see AI guardrails.
Keeping findings from regressing
A finding is more useful once it can be replayed. In HoneyHive you can put attack prompts in a dataset and score outputs with an evaluator in an offline experiment to catch regressions (experiments docs).
FAQ
What is the difference between red teaming and penetration testing?
A penetration test tries to circumvent the security features of a system. NIST's control CA-8(2) says red team exercises "extend the objectives of penetration testing" by assessing an organization's security posture and its ability to defend against adversary behavior, including social engineering.
Is a red team the same as a pentest team?
Not by definition. NIST defines a red team as people authorized to "emulate a potential adversary's attack or exploitation capabilities" against an organization's security posture. Testers may do both kinds of work, but the goals and scope differ.
Does AI red teaming mean the same thing as security red teaming?
Not entirely. Microsoft says the term has "extended beyond traditional cybersecurity" to describe many kinds of probing of AI systems, including harmful output from benign use.
Can a penetration test replace AI red teaming?
Only for the security part. Microsoft's team says AI red teams should watch for cyberattack vectors "both old and new", which includes ordinary application flaws and AI-specific ones. Harmful or inaccurate output from ordinary use is outside what a classic pentest looks for.