Red team, blue team, and purple team are three distinct approaches to security testing that serve different purposes. The red team attacks. The blue team defends. The purple team makes sure the two sides learn from each other. Most organisations start with penetration testing, progress to red teaming as they mature, and adopt purple teaming when they want to maximise the value of both. This guide explains what each team does, how they work together, and when each approach is appropriate.
Table of contents
Comparison Table
| Red Team | Blue Team | Purple Team | |
|---|---|---|---|
| Role | Offensive – simulate attacks | Defensive – detect and respond | Collaborative – attack + defend together |
| Objective | Achieve goals, test detection gaps | Detect, contain, and respond to threats | Improve detection by sharing attack knowledge |
| Stealth | Essential (tests real detection) | N/A (they are the defenders) | Optional (focus is on learning, not stealth) |
| Engagement type | Adversary simulation exercise | Ongoing security operations | Collaborative workshop or exercise |
| Duration | 2-14 weeks | Continuous (SOC, IR team) | Days to weeks (structured sessions) |
| Output | Attack narrative + detection gaps | Detection metrics, incident reports | Detection rule improvements, playbook updates |
| Best for | Testing defences against realistic attacks | Day-to-day threat monitoring and response | Maximising defensive capability improvement |
What Is a Red Team?
A red team simulates a real adversary. The team is given specific objectives – achieve domain admin, exfiltrate customer data, deploy simulated ransomware – and uses whatever techniques are needed to reach them: network exploitation, phishing, vishing, physical access, social engineering, and custom tooling.
The defining characteristic of red teaming is stealth. The blue team (the organisation’s SOC, IR team, and security operations) is not told that an exercise is happening. This tests real-world detection and response capabilities. If the red team achieves its objectives without being detected, that is a finding about the organisation’s defensive posture, not just a technical vulnerability.
Red team exercises produce an attack narrative – a story of how the team progressed from initial access to objective completion, what techniques they used at each stage (mapped to MITRE ATT&CK), where they were detected, and where they evaded detection. This narrative is far more valuable to a CISO than a list of CVEs.
What Is a Blue Team?
The blue team is your defensive security operation – the SOC analysts, incident responders, threat hunters, and security engineers who monitor, detect, and respond to threats day-to-day. They manage SIEM/SOAR platforms, write detection rules, investigate alerts, contain incidents, and maintain security tooling.
Blue team capabilities are tested by red team exercises. Without periodic adversary simulation, the blue team cannot know whether their detections actually work against real attack techniques. Alert rules that fire on test payloads in a lab may fail against obfuscated or novel techniques in production. Red teaming reveals these gaps.
Blue team maturity is the prerequisite for red and purple teaming. An organisation without a functioning SOC, without SIEM, and without an incident response plan gets limited value from a red team exercise because there are no defences to test. Penetration testing to find and fix vulnerabilities is the right starting point.
What Is a Purple Team?
Purple teaming is a collaborative exercise where the red team and blue team work together in real time. Instead of the red team attacking covertly and the blue team discovering attack traces after the fact, both sides sit in the same room (or call) and walk through attack techniques together.
The red team executes a technique (e.g., Kerberoasting). The blue team checks: did we detect it? Did an alert fire? If not, why? They then write or tune detection rules, test again, and confirm the gap is closed. The exercise progresses through a library of techniques, systematically improving detection coverage.
Purple teaming sacrifices the realism of a covert red team exercise in exchange for faster, more targeted defensive improvement. A two-week red team might reveal five detection gaps. A one-week purple team exercise might close 30 detection gaps because the feedback loop is immediate rather than retrospective.
How They Work Together
The three approaches are not competing – they are stages of a security maturity journey:
- Foundation: pen testing. Find and fix technical vulnerabilities in applications and infrastructure. This is where every organisation starts. Annual pen testing is the baseline.
- Build defences: blue team. Establish a SOC, deploy SIEM, write detection rules, build incident response playbooks. You need something to defend before you can test defences.
- Test defences: red team. Once you have detection and response capabilities, red teaming tests whether they work against a realistic adversary. This reveals the gap between theoretical coverage and operational reality.
- Improve defences: purple team. Use the findings from red team exercises to drive structured improvement sessions. The red team replays techniques. The blue team tunes detections. Both learn.
- Repeat. The cycle continues – each round improves the organisation’s ability to detect and respond to attacks.
Real-World Exercise Examples
Red team example. A financial institution commissions a CBEST exercise. The red team conducts OSINT, crafts targeted phishing emails to the finance department, gains initial access through a macro-enabled document, escalates via a Kerberoastable service account, achieves domain admin, and accesses the SWIFT messaging system. The SOC detected the phishing email but not the lateral movement. The finding: network segmentation and AD monitoring need improvement.
Blue team example. The SOC receives an alert from their EDR about suspicious PowerShell execution. They investigate, identify the compromised host, contain it by isolating the network segment, and discover that an attacker used a phishing email to deploy a reverse shell. They invoke the IR plan, forensically image the host, and determine the blast radius. Total detection-to-containment time: 4 hours.
Purple team example. The red team and blue team spend a week in a structured workshop. Day 1: initial access techniques (phishing, credential stuffing). The red team executes each technique. The blue team verifies detection coverage and tunes rules that missed. Day 2: persistence and privilege escalation. Day 3: lateral movement. Day 4: data exfiltration. Day 5: review and documentation. By end of week, 25 detection rules are created or updated, covering techniques mapped to MITRE ATT&CK.
When to Use Each Approach
- No SOC, early security maturity: Start with penetration testing to find and fix technical vulnerabilities. Red and purple teaming add limited value without defensive infrastructure to test.
- SOC in place, want to validate detection: Commission a red team exercise. The attack narrative will reveal where your detections succeed and fail against realistic adversary behaviour.
- Mature SOC, want to improve systematically: Run purple team exercises. The collaborative format produces faster defensive improvement than covert red teaming alone.
- Regulatory requirement (CBEST, TLPT): These frameworks specifically require red team exercises with threat intelligence components.
- AI/LLM systems: AI red teaming adds a separate dimension for testing model-specific attack surfaces.
FORTBRIDGE is a CREST-accredited penetration testing company offering pen testing, red team, and purple team services across web applications, networks, and LLM applications. Get in touch to discuss which approach fits your organisation’s maturity and objectives.
Frequently Asked Questions
What is the difference between red team, blue team, and purple team?
Red team attacks (adversary simulation). Blue team defends (detection and response). Purple team combines both in a collaborative exercise to improve defensive capabilities faster. Red tests if defences work. Purple makes them better.
Do I need a red team if I already pen test?
Pen testing finds technical vulnerabilities. Red teaming tests whether your SOC and IR team detect and respond to an actual attack campaign. If you have defensive capabilities (SOC, SIEM, EDR) and want to validate they work, red teaming adds value that pen testing alone cannot provide.
What is purple teaming?
Purple teaming is a collaborative exercise where the red team executes attack techniques and the blue team verifies detection in real time. Together they tune detection rules, close coverage gaps, and improve defensive playbooks. It trades realism for faster, more targeted improvement.
When should an organisation start red teaming?
After you have a functioning blue team (SOC, SIEM, incident response plan) and have been pen testing regularly to fix technical vulnerabilities. Red teaming tests defences – you need defences in place before testing them.
Is purple teaming better than red teaming?
They serve different purposes. Red teaming tests real-world detection under realistic conditions. Purple teaming maximises the speed of defensive improvement. Many mature organisations alternate between covert red team exercises (to test real detection) and collaborative purple team sessions (to close gaps found during red teaming).
About Post Author
