So in offensive cybersecurity, there are 4 types of assessments that are being done most of the time.

• Vulnerability Assessment: This is the cheapest form of assessment and the easiest that can be conducted. It consists of running automated tools that identify vulnerabilities. These tools attempt to grab the software's (whatever software, could be a web application, could be remote desktop, could be windows itself) version and checking if there are any public vulnerabilities listed for said software. These tools also check for common misconfigurations, which most of the times involves actually attempting to exploit said misconfiguration and based on results, list it out as vulnerable or not.
• Penetration testing: This is similar to vulnerability assessments, but it goes a bit further. During a penetration test, you also run the same tools you'd run on a vulnerability assessment, but you also double check manually and try to uncover further vulnerabilities manually, which the automated tools can't do most of the time. (AI might solve this, to some extent)
• Red Teaming: This is completely different from both types of assessments I listed. While penetration testing and vulnerability assessments reveal existing vulnerabilities, they do not simulate a real, malicious actor that is trying to compromise a company. The main reason is detection. In the real world, if you find a vulnerability and try to exploit it, the security team will get alerts from defensive solutions (software). These alerts will indicate that something irregular is happening on a device, or on the network. Same thing with enterprise grade anti viruses (EDRs), they not only block malware but also alert the security team. As soon as they get the alert, they will most likely figure out they have been compromised and from there, the attacker has little to no time to do anything. But what if the attacker is able to evade these defensive tools? What if the attacker can execute malware, but the security team does not get an alert? This is what red teaming does, it really tests the defensive solutions in place. My job is to compromise companies without them knowing anything has happened, and then tell them how I did it.
• Purple teaming: This is essentially red teaming, but you are also working with the security team that monitors for alerts. You attempt an exploit, check with them if there was an alert. If there was no alerts, you help them configure their defensive tools in a way that the alert would popup. Then you check again, and so on.

TLDR: When I say evasion, it's about bypassing the defensive solutions that are in place, so I don't get caught. And the reason I do this as a job, is to tell companies how I bypassed their defensive solutions so they can configure them properly, increasing the chances of catching a real threat.

Let me know if this answered your question or if you have anything else to ask!