The short answer: a vulnerability scan is an automated tool that lists known weaknesses, a penetration test is a skilled human proving which weaknesses an attacker could actually exploit, and a red team engagement is a covert, weeks-long simulation of a real adversary that tests your people and detection capability as well as your technology. They differ in depth, cost and purpose — and most Australian businesses need them in exactly that order.

The confusion is not academic. We regularly meet businesses that paid pen-test prices for a rebadged automated scan, and others that were sold a red team engagement when they had no monitoring in place to detect it — which is a very expensive way to learn nothing. According to the Australian Signals Directorate’s Annual Cyber Threat Report, a cybercrime is reported in Australia roughly every six minutes, and Google Mandiant’s research puts the average time between a vulnerability being disclosed and being exploited at about five days. Knowing which form of testing you need, and when, is now a core business decision rather than an IT nicety.

What is a vulnerability scan?

Scanning is the smoke detector of security testing: inexpensive, automated and designed to run constantly. A scanner will tell you that a server is missing a critical patch or that a firewall port is open to the internet, and it will tell you within hours of the problem appearing. What it cannot do is think. It will not chain three low-severity findings into a path to your customer database, it cannot judge business context, and it produces false positives that need human review.

Because the average time from disclosure to exploitation of a new vulnerability is now measured in days rather than months, an annual scan is close to worthless. Scanning belongs in the “always on” category — continuous or at least monthly — and in a well-run environment it is bundled into your managed cyber security services rather than purchased as a one-off event.

Watch out for: providers selling an automated scan report at penetration-test prices. If the engagement took a day, nobody spoke to your team about scope, and the “report” is raw scanner output with a new cover page, you bought a scan — whatever the invoice says.

What is penetration testing?

Where a scanner reports “this door lock is an old model”, a penetration tester picks the lock, walks inside, and shows you exactly which filing cabinets they could open. That difference — demonstrated impact versus theoretical weakness — is what boards, auditors, insurers and enterprise customers are asking for when they request a “pen test report”. Good testing follows recognised methodologies such as OWASP and MITRE ATT&CK, and in Australia the strongest signal of quality is a provider whose testers hold CREST certification.

Common types of penetration test include:

• External network testing — your internet-facing systems: firewalls, VPNs, mail gateways and anything an attacker can reach without credentials.
• Internal network testing — what an attacker (or malicious insider) could do after getting a foothold: privilege escalation, lateral movement and access to sensitive data.
• Web application and API testing — customer portals, booking systems and SaaS platforms, including logic flaws no scanner can find.
• Cloud and Microsoft 365 configuration testing — identity, permissions and tenant hardening in the environments where most Australian SMBs now actually live.
• Social engineering — controlled phishing and pretexting exercises that test your people alongside your technology.

A pen test is typically a one-to-two-week engagement against a defined scope, your IT team usually knows it is happening, and the goal is breadth: find and verify as many exploitable issues as possible, then hand you a prioritised plan to fix them. The deliverable that matters is not the moment of compromise — it is the report, the debrief and the retest that confirms your fixes worked.

What is red teaming?

A red team is given a mission, not a checklist: “access the payroll system”, “exfiltrate the client database”, “take control of the domain”. Only a small trusted group inside your business knows the exercise is running. The operators move slowly and quietly, blending in with normal activity, using phishing, stolen credentials, physical intrusion or whatever a genuine attacker would use. Success is measured on two sides at once: what the red team achieved, and what your defenders noticed while it was happening.

That second half is the point — and it is why buying a red team engagement too early is the most common and expensive mistake in security testing. If you have no 24/7 monitoring, no endpoint detection, and no incident response plan, a red team will succeed in week one, your organisation will detect nothing, and you will have paid $40,000 or more to confirm what a $10,000 penetration test would have told you with far more actionable detail. Red teaming is the final exam. Sit it after you have done the coursework: baseline controls in place, penetration test findings remediated, and a detection capability — in-house or through a managed detection and response partner — genuinely worth examining.

Vulnerability scanning vs penetration testing vs red teaming: side by side

The three engagements sit on a spectrum. As you move from left to right, breadth gives way to depth, automation gives way to human expertise, and the question being answered changes from “what is weak?” to “what can be exploited?” to “would we even notice?”

Red team vs blue team vs purple team: who does what?

Security testing borrows its colour scheme from military exercises, and the jargon trips up a lot of buyers. It is simpler than it sounds:

• The red team plays offence. Ethical hackers who think and act like attackers — penetration testers and red team operators both sit on this side.
• The blue team plays defence. The people watching logs and alerts, hunting threats, and responding to incidents. Very few Australian businesses under 200 staff can justify an in-house 24/7 blue team — which is why most consume this capability as a managed detection and response (MDR) service.
• Purple teaming is the two working together. Not a third department — a way of running exercises. The red team executes a technique, the blue team says what they saw (or did not see), detection is tuned on the spot, and the technique is run again. Attack knowledge converts directly into defensive improvement, in hours instead of months.

A useful rule of thumb from the industry: red and blue are nouns, purple is a verb. You do not hire a purple team; you run purple team exercises with your testing provider and whoever handles your detection. For a mid-sized Australian business, a half-day purple exercise pairing your MDR provider with a penetration tester is often the single highest-value hour-for-hour spend in the entire security budget — every technique either validates a detection or creates one.

Which one does your business actually need?

Match the engagement to your maturity, not to the most impressive-sounding proposal. Here is the decision path we walk new clients through:

Three mistakes to avoid, because we see them constantly:

• Buying a red team before you can detect one. Fix the basics and build monitoring first — otherwise you are paying a premium to be told you have no locks.
• Treating a scan as a pen test. Insurers, auditors and enterprise clients increasingly reject scanner output dressed up as testing — and so should you.
• Testing once and filing the report. An unremediated finding is a documented liability. Budget for the fixes and the retest, not just the test.

The Australian compliance drivers (including the Essential Eight change)

No single Australian law says “thou shalt pen test”. In practice, a web of obligations and commercial pressures gets you to the same place:

• APRA CPS 234 requires banks, insurers, superannuation funds and other regulated entities to systematically test the effectiveness of their information security controls, using appropriately skilled and functionally independent testers. If you serve APRA-regulated clients, expect those obligations to flow down the supply chain to you. Our guide to cyber security for financial services covers this in depth.
• The Privacy Act requires reasonable steps to protect personal information, and penalties for serious or repeated breaches now reach $50 million or more. Demonstrating regular independent testing is one of the clearest ways to evidence “reasonable steps” after an incident.
• ISO 27001 certification expects a managed program of technical vulnerability identification and testing — auditors will ask for scan records and test reports.
• PCI DSS mandates penetration testing for any environment that stores, processes or transmits card data.
• Cyber insurance and enterprise procurement are, for many SMBs, the real forcing functions. Renewal questionnaires and tender security schedules increasingly ask the same two questions: when was your last penetration test, and were the findings remediated?

How often should you test?

What security testing costs in Australia in 2026

Most providers hide pricing behind “contact us”. Based on published Australian market pricing in 2026, here are honest indicative ranges (AUD, excluding GST). Scope is the dominant variable — the number of applications, hosts, user roles and locations — so treat these as planning figures, not quotes.

Indicative ranges, AUD excluding GST, based on published Australian market pricing surveyed July 2026.

Two pricing signals worth heeding. A quote dramatically below these ranges usually means automated scanning in disguise, offshore delivery with no accountability under Australian law, or a scope so narrow the report will not satisfy whoever asked for it. And a quote without a scoping conversation is a template, not an assessment — nobody can price testing your environment without asking questions about your environment.

How to choose a testing provider: a seven-point checklist

Frequently asked questions

What is the difference between a vulnerability scan and a penetration test?

A vulnerability scan is an automated check that lists known weaknesses such as missing patches and misconfigurations. A penetration test is a manual engagement in which a qualified specialist actively exploits weaknesses and chains them together to show what an attacker could really achieve. Scans find known issues cheaply and often; pen tests prove real-world impact.

What is the difference between penetration testing and red teaming?

Penetration testing aims to find as many exploitable weaknesses as possible within an agreed scope, and your teams usually know it is happening. Red teaming is a covert, objective-driven simulation of a real adversary that also tests your people, processes and detection capability — deeper, longer and significantly more expensive.

How much does penetration testing cost in Australia?

In 2026, most Australian penetration tests fall between $5,000 and $40,000 AUD depending on scope. A single web application test typically costs $5,000–$20,000, external network testing $6,000–$15,000, and internal testing $10,000–$30,000. Red team engagements generally start around $40,000 and can exceed $100,000.

How often should a business do penetration testing?

At least annually, and after significant change: a new customer-facing application, a cloud migration, a merger or a major network redesign. Vulnerability scanning should run continuously in between. APRA-regulated entities need a systematic testing program under CPS 234, and many insurers and enterprise customers now require evidence of annual testing.

What are red, blue and purple teams?

The red team plays offence, simulating attackers to expose weaknesses. The blue team plays defence — monitoring, detecting and responding; most Australian SMBs deliver this through a managed detection and response (MDR) service. Purple teaming is the two working together transparently so every attack technique immediately becomes better detection.

Is penetration testing mandatory in Australia?

No single law mandates it for every business, but it is effectively required in many situations: APRA CPS 234 requires systematic control testing, ISO 27001 expects technical testing, PCI DSS mandates it for card environments, and insurers and enterprise procurement teams increasingly demand recent reports before signing.

Does the retirement of the Essential Eight change testing requirements?

No — if anything it raises the bar. The ASD confirmed in June 2026 that the Essential Eight will be deprecated in around 12 months and retired within about 24, replaced by an outcomes-based Essentials series, with existing controls carrying over. Outcome-based guidance makes independent testing the primary way to prove your security actually works.

What should a penetration test report include?

An executive summary in business language, scope and methodology, findings rated by severity with evidence and reproduction steps, a prioritised remediation plan, and strategic recommendations. A reputable provider will walk your team through the findings and include a retest to verify the fixes worked.

Related reading

• Cyber Security for Financial Services: A Practical Guide for Australian Firms
• 12 Cyber Security Tips for Business
• Cyber Security Consulting Services

Sources and further reading

Australian Signals Directorate — Annual Cyber Threat Report and Essential Eight guidance (cyber.gov.au)  •  iTnews, “ASD to retire Essential Eight cyber security framework within next two years”, 24 June 2026 (itnews.com.au)  •  APRA Prudential Standard CPS 234 Information Security (apra.gov.au)  •  OAIC, Privacy Act penalty guidance (oaic.gov.au)  •  Google Mandiant time-to-exploit research. Cost ranges reflect published Australian security-testing pricing surveyed July 2026 and are indicative only.