Red team, blue team, and purple team: who is who

The red team measures how far someone can get. The blue team measures how fast it gets noticed. The purple team is the way to turn both into one usable piece of information: a rule that will fire next time.

A red team plays the attacker under an agreed scenario and goes after one objective, not after a list of vulnerabilities. It doesn’t announce itself, it works quietly, and one thing gets measured: how far it got and when somebody noticed. The techniques in the scenario don’t come out of thin air; the basis is the catalog of techniques a scenario is built from. A mid-sized company buys a red team from outside, because only a large organization keeps a standing offensive team busy.

The techniques themselves are preceded by gathering information from open sources, which is where the scenario comes from. Every such operation needs written rules of engagement and a small circle of insiders, otherwise there would be nothing to measure. What a scenario-based operation against the whole defense looks like, from agreeing on the objective to the report, is on the service page.

The blue team is the defense in everyday operations: it collects logs, evaluates alerts, closes incidents, and keeps the detections meaningful. It is measured on time to detect and time to stop an attack. Without central log collection and without someone who looks at the alerts, a blue team doesn’t really exist, even if the company has bought the tools.

It needs three things for its work: telemetry from workstations and servers, one place where it is evaluated, and the authority to disconnect a system without waiting for sign-off. The weak point doesn’t have to be the tool, though. It can be capacity. When more alerts arrive than one person can go through, they stop being read, and another tool changes nothing about that.

A purple team is a way of working rather than a team. It means the attacking and the defending side sit at one table and go through the steps of the attack together: this step happened at 9:14 a.m., is it anywhere in the logs? The goal is neither a score nor a winner, but a new or corrected rule for every step that passed unnoticed.

For that to work, both sides need the same vocabulary. Most often that is the catalog of attacker techniques, from which you can take the survey of tactics for the enterprise environment and walk through it as an outline. In companies with their own security operations center (SOC) this sometimes becomes a standing role. More often it is joint tuning of detections after an operation over one or two days.

In a mid-sized company none of the three roles has to have a team of its own. The blue team is then one administrator who, next to the logs, also handles the printers and buys the laptops. The red team is bought from outside for individual operations. The purple team is a meeting where the two sit down and go through what happened.

That isn’t a criticism, it is a budget. A company with two hundred employees won’t keep a twelve-person SOC and has no reason to. The practical consequence is that texts written for American corporations read badly here: they talk about departments where we have one person and a contract with a monitoring vendor.

For planning, one order of steps follows from this. Before buying an attack makes sense, somebody has to exist who would catch it. Otherwise the operation buys you expensive proof that nobody reads the logs, and that can be found out more cheaply.

Less than is commonly written. A penetration tester is not a red team: they work with IT’s knowledge, in an announced window, and look for as many vulnerabilities as possible in a given scope. A red team goes after one objective and hides on purpose, because it measures detection, not coverage. It tends to be the same people, but the brief is different. Where both sit next to the other forms of verification is shown by the survey of test types by subject.

The choice between the two follows the maturity of the defense, not the size of the company. A separate article covers when each of the two pays off, and that belongs to the decision earlier than the pricing does.