Red Team vs Blue Team vs Purple Team: Roles, Differences and How They Work Together
The terms come from military exercises, where one side plays the attacker and the other defends. In cybersecurity they describe three different ways of testing and improving an organization’s defenses: the red team attacks, the blue team defends, and the purple team brings the two together so that every attack becomes a lesson for the defenders.
This guide explains red team vs blue team vs purple team: what each one does, the skills and tools involved, how they interact, how red teaming differs from penetration testing and how to decide which kind of exercise your organization needs.
Red, Blue and Purple Teams at a Glance
- Red team: an offensive group that emulates real adversaries to test whether an organization can be compromised and whether the attack is detected.
- Blue team: the defenders who protect the organization day to day: security operations, detection engineering, incident response and threat hunting.
- Purple team: a collaborative exercise, or function, in which red and blue work side by side, running attacks and improving detection and response in real time.
| Red team | Blue team | Purple team |
|---|---|---|---|
Role | Attack, emulating real adversaries | Defend, detect and respond | Connect attack and defense |
Main question | Can an adversary reach our critical assets without being stopped? | Can we detect, contain and recover from attacks? | Which attacks do we detect, and how do we close the gaps? |
Mindset | Think like an attacker | Think like a defender | Shared learning |
Visibility | Usually covert; few defenders know | Works in the open every day | Fully transparent |
Typical duration | Weeks to months per exercise | Continuous | Days to weeks per exercise |
Output | Attack narrative, objectives reached, detection gaps | Alerts, investigations, incident reports | New and tuned detections, improved playbooks |
Key frameworks | MITRE ATT&CK, TIBER-EU | MITRE ATT&CK, MITRE D3FEND, NIST incident handling guidance | MITRE ATT&CK |
What Does a Red Team Do?
A red team emulates a realistic adversary, often a specific threat actor relevant to your industry, and tries to achieve defined objectives such as accessing payment systems, exfiltrating customer data or gaining control of a critical production environment. Unlike a penetration test, the goal is not to find every vulnerability. It is to answer whether a determined attacker could reach what matters most, and whether your people, processes and technology would notice and stop them.
How a Red Team Engagement Works
- Threat intelligence and planning: identify the adversaries most likely to target the organization and the techniques they use, then define objectives (sometimes called flags or crown jewels) and rules of engagement.
- Reconnaissance: gather information about people, technology and exposed assets.
- Initial access: use realistic techniques such as phishing, exploiting exposed services or abusing stolen credentials, and sometimes physical access.
- Establish and maintain access: set up command and control while trying to stay below the radar of security monitoring.
- Privilege escalation and lateral movement: move toward the objectives, often through identity systems such as Active Directory or cloud identity providers.
- Objective and reporting: demonstrate impact on the objectives, then document the full attack path alongside a timeline of what defenders did or did not detect.
What Makes Red Teaming Different
- Stealth matters. Most of the blue team usually does not know the exercise is running, so the test reflects real detection and response.
- Objectives over coverage. The red team takes the path a real attacker would take, not every possible path.
- People and process are in scope. Phishing, help desk procedures and escalation decisions are tested along with technology.
- Adversary emulation. Techniques are mapped to frameworks such as MITRE ATT&CK, so findings can be compared directly with the organization’s detection coverage.
See our Red Team & Purple Team service for how we run these engagements.
What Does a Blue Team Do?
The blue team is responsible for defending the organization every day, not only during exercises. In most organizations it is not a single team but a set of functions:
- Security operations (SOC): monitoring alerts from security tools, triaging them and escalating real incidents.
- Detection engineering: writing and tuning the rules and analytics that turn logs into meaningful alerts.
- Incident response: containing, investigating and recovering from incidents, and coordinating with the business, legal teams and authorities when necessary.
- Threat hunting: proactively searching for attackers who have evaded existing detections. See our Threat Intelligence & Threat Hunting service.
- Hardening and vulnerability management: reducing the attack surface through secure configuration, patching and access control.
How Blue Team Performance Is Measured
Common measures include the time it takes to detect an intrusion, the time to contain it, the share of relevant attack techniques covered by working detections and the false positive rate of alerts. A red team exercise is one of the few ways to measure these against a realistic attacker instead of an assumption.
Tools and Frameworks
Blue teams typically rely on a SIEM for log collection and correlation, endpoint detection and response (EDR) on workstations and servers, network monitoring and identity protection. MITRE ATT&CK describes attacker techniques that detections should cover, MITRE D3FEND catalogs defensive techniques, and NIST’s incident handling guidance provides a reference process for responding to incidents. Exercises such as incident response tabletop exercises test the human side of response without a live attack.
What Is a Purple Team?
In a traditional red team exercise, the defenders find out what they missed only when the report arrives, weeks later. Purple teaming removes that delay. Red and blue work together openly: the red team executes a technique, the blue team checks whether it was logged and detected, and both improve detection on the spot.
Purple teaming is usually an exercise rather than a permanent team, although some organizations create a dedicated purple function to run these exercises regularly.
How a Purple Team Exercise Works
- Choose the techniques. Select the techniques relevant to the threats you face, usually mapped to MITRE ATT&CK, for example credential dumping, Kerberoasting, lateral movement over remote services or data exfiltration over web protocols.
- Execute. The red team runs each technique in a controlled way, announcing what it is doing and when.
- Observe. The blue team checks whether the activity was logged, whether an alert fired and whether the alert would lead an analyst to the right conclusion.
- Improve. Where detection is missing or weak, the teams add log sources, write or tune detection rules and update response playbooks.
- Retest. The technique is executed again to confirm the new detection works.
- Record. The results become a coverage map showing which techniques are prevented, detected or missed.
Example: Turning One Technique into a Detection
The red team requests Kerberos service tickets for accounts with service principal names, a technique known as Kerberoasting. The blue team finds that the activity was logged by the domain controllers but no alert fired, because the relevant event logs were not collected by the SIEM. The teams add the log source, write a detection for unusual service ticket requests, rerun the technique and confirm the alert now fires with enough context for an analyst to act. A gap that a real attacker could have used for months is closed in an afternoon.
What About the White Team?
In red team exercises, a small white team (sometimes called the control group) oversees the engagement. It approves the scope and rules of engagement, knows the exercise is running, de-conflicts if the blue team escalates a red team action as a real incident and can stop the exercise if business risk becomes unacceptable. Frameworks such as TIBER-EU formalize this role.
Red Teaming vs Penetration Testing
The two are often confused. A penetration test tries to find as many exploitable weaknesses as possible in a defined scope, usually with the security team’s knowledge. A red team exercise pursues specific objectives through any realistic path, usually covertly, and measures detection and response as much as vulnerabilities.
| Penetration test | Red team exercise |
|---|---|---|
Goal | Find and prove as many weaknesses as possible | Reach defined objectives like a real adversary |
Scope | Defined systems or applications | The whole organization, including people and processes |
Awareness | Security team usually informed | Only a small control group informed |
Stealth | Not a priority | Central to the exercise |
Measures | Vulnerabilities and their impact | Detection, response and resilience |
Typical frequency | Annually and after major changes | Periodically, once foundations are in place |
Which Approach Does Your Organization Need?
There is a natural maturity path:
- Build the foundations. Regular vulnerability management and penetration testing fix the obvious weaknesses. A red team engagement against an environment full of known issues mostly confirms what a penetration test would have found more cheaply.
- Establish a blue team capability. Centralized logging, endpoint detection and a defined incident response process, whether in-house or through a managed security service.
- Run purple team exercises. Systematically test and improve detection coverage for the techniques most relevant to you. This is often the fastest way to raise detection maturity.
- Run red team exercises. Once detection and response are in place, test them against a realistic, covert adversary.
- Repeat. Use red team findings to drive the next purple team exercises.
As a rule of thumb: if you are unsure whether your security monitoring would notice a common attack technique, start with purple teaming. If you are confident it would, a red team will tell you whether that confidence holds against a determined adversary.
Regulatory Red Teaming: DORA, TLPT and TIBER-EU
In the European financial sector, red teaming is no longer only a best practice. The Digital Operational Resilience Act (DORA), applicable since 17 January 2025, requires financial entities identified by their competent authorities to carry out threat-led penetration testing (TLPT) at least every three years. TLPT covers critical or important functions on live production systems and must follow the TIBER-EU framework (Threat Intelligence-Based Ethical Red Teaming) developed by the European Central Bank. A TLPT combines a threat intelligence phase with a red team testing phase, and the framework also describes a closing phase in which red and blue teams review the exercise together, similar to purple teaming.
Comparable frameworks exist elsewhere, such as CBEST in the United Kingdom. Even for organizations outside their scope, these frameworks are a useful reference for how a mature, intelligence-led red team exercise should be structured.
Frequently asked questions
Conclusion
Red, blue and purple are not competing approaches but parts of the same cycle. The blue team defends every day, the red team shows how a real adversary would get past those defenses, and purple teaming turns each attack into a concrete improvement. Organizations that run this cycle regularly know not only where their vulnerabilities are, but whether they would catch an attacker using them.
Ready to test your defenses against a realistic adversary? Explore our Red Team & Attack Simulation services or talk to our team to plan a red or purple team exercise.
Subscribe to our cyber security newsletter