ComparisonAudit, pentest, penetration test, red team:
Audit, pentest, penetration test, red team:
what does each one actually mean?
These terms get used interchangeably, but they describe different approaches with different scopes, costs, and regulatory weight. Here is how to tell them apart and pick the right one for your situation.
The 4 approaches compared
| Criterion | External review | Penetration test (pentest) |
|---|---|---|
| Method | Observation and analysis from the outside, no access needed | Simulated attack with formal authorization |
| Common synonyms | Security audit, application audit, security review | Pentest, penetration testing, intrusion testing |
| Authorization required | None (read-only, public surface) | Required (contract, scope, rules of engagement) |
| Typical duration | 1 to 5 days | 2 to 6 weeks |
| SMB cost | EUR 1,900 to 4,200 | EUR 5,000 to 25,000 |
| What is tested | Exposure surface, APIs, auth, accessible data, configuration | Resistance to active attacks, exploitation, escalation |
| Production impact | Zero | Risk of controlled disruption |
| Report | Reproducible evidence, GDPR context, remediation | Attack paths, documented exploitation |
| Regulatory value | GDPR due-diligence evidence (Art. 32) | Required by DORA, PCI-DSS (advanced levels), some insurers |
| Red team (advanced variant) | Not applicable | Extended version: multi-vector attack (phishing + technical + physical), targets the whole organization |
Start with an external review if...
- Your application has never been audited
- You do not have a dedicated security team
- You need fast, actionable results
- You need to demonstrate a security process (GDPR, client, investor)
- Your budget does not stretch to a formal pentest
- You want to know what is exposed before testing resistance
Move to a pentest if...
- Exposure flaws are fixed and you want to test depth
- Your industry requires a formal penetration test (DORA, PCI-DSS, cyber insurance)
- You are preparing for ISO 27001 or SOC 2 certification
- You have a technical team that can support active testing
- You want to simulate a realistic end-to-end attack scenario