Red, Blue, and Purple Teams
Red, blue, and purple describe the roles in adversarial security testing. Red teams attack, emulating real adversaries. Blue teams defend, detecting and responding. Purple is not a third team but the practice of the two working together so that every attack teaches the defense something. The colors are a vocabulary for organizing offensive and defensive work.
What does each team do?#
- Red team — emulates a specific threat actor pursuing a goal (e.g. “reach the customer database”) while avoiding detection. It tests people, process, and technology, not just bugs.
- Blue team — the defenders: monitoring, detection engineering, incident response, and hardening. They run the SOC and own the alerts.
- Purple team — red and blue collaborating openly. Red runs a technique, blue checks whether they can see it, and detections improve on the spot.
| Red | Blue | Purple | |
|---|---|---|---|
| Goal | Emulate the adversary | Detect and respond | Improve detection together |
| Mindset | Offensive | Defensive | Collaborative |
| Output | Attack path, gaps | Alerts, containment | Tuned, measured detections |
Why does purple teaming matter?#
Because red-versus-blue as a contest wastes the lesson. If the red team “wins” silently, the blue team learns nothing actionable. Purple teaming turns each technique — mapped to MITRE ATT&CK — into a concrete question: can we detect this, and if not, how do we fix that today?
These roles are the human structure behind detection and response. Explore the defensive side at the Defense & Hardening hub, and more foundations at the Security Fundamentals hub.
Frequently asked questions#
What is the difference between a red team and a penetration test?
A penetration test finds as many vulnerabilities as possible in a defined scope within a set time. A red team engagement is goal-oriented and adversarial — it emulates a real threat actor trying to achieve a specific objective while staying undetected, testing not just vulnerabilities but the blue team’s detection and response.
What does a purple team do?
A purple team is not a separate group so much as a way of working: red and blue collaborate directly, with attackers running techniques while defenders watch and tune detections in real time. The goal is measurable improvement in detection and response, not a win-or-lose exercise between two sides.