# What Are Red Team, Blue Team and Purple Team? How Do They Differ?

**URL:** https://securesys.com.tr/en/learning/red-teaming-threat-intelligence/red-team-blue-team-purple-team-differences

![What Are Red Team, Blue Team and Purple Team? How Do They Differ?](/images/bilgi-merkezi/covers/cover-redteam-02.webp)

An organisation can invest millions in cyber security.

Firewall, EDR, XDR, SIEM, SOAR, WAF, PAM, DLP and MFA can all be running at the same time.

But the number of products in use is not what determines the success of cyber security.

The real question is this:

#### When an attack begins, can the organisation genuinely notice it and stop it?

To answer that question, three important concepts appear in the modern cyber security world:

**Red Team, Blue Team and Purple Team.**

Put in the simplest terms;

**the Red Team thinks like an attacker.**

**The Blue Team acts like a defender.**

**And the Purple Team brings attack and defence knowledge together to improve the organisation's security capability.**

But the relationship between these three concepts is far broader than that.

Because to succeed against a real attack it is not enough to know attack techniques alone, or to manage security products alone.

You have to evaluate together how attacker behaviour actually plays out, which security controls can detect it, and how security teams respond to incidents.

#### What Is a Red Team?

The Red Team is the side that tests an organisation's security defences by simulating, in a controlled manner, the methods real attackers could use.

Red Team specialists ask themselves this question:

**“If we genuinely wanted to attack this organisation, how would we reach our objective?”**

For that reason Red Team work is not limited to scanning for vulnerabilities.

Depending on the scope of the operation, different techniques may be considered, such as;

- open source intelligence (OSINT),
- attack surface discovery,
- social engineering,
- identity security testing,
- Active Directory attack scenarios,
- privilege escalation,
- movement within the network,
- evasion of security controls,
- Command & Control simulations,
- access scenarios against critical systems.

All of these may be evaluated.

The fundamental aim here is not to harm the organisation.

The aim is to uncover the routes a real attacker could use before the attacker finds them.

### The Red Team's Goal Is Not to Find a Vulnerability

One of the most important differences between a Red Team and a classic penetration test is the approach to the objective.

In a web application penetration test the objective is usually to identify security vulnerabilities in the web application.

In a Red Team operation the objective can be quite different.

For example:

**“Can the critical finance system be reached through an attack that starts on the internet?”**

or:

**“Can Domain Admin level be reached from a standard user account?”**

or indeed:

**“Can the organisation's security operations centre detect attacker behaviour?”**

In this case the Red Team investigates not a single system, but the attack routes that could lead to the objective.

An attack chain might form like this, for example:

#### OSINT

↓

#### Initial Access

↓

#### User Account

↓

#### Credential Access

↓

#### Privilege Escalation

↓

#### Lateral Movement

↓

#### Critical System

Each stage here may be a separate security problem.

The Red Team's job is to see whether these pieces can be chained to one another.

### What Is a Blue Team?

While the Red Team simulates the attack, the Blue Team is responsible for the defence.

The Blue Team's core purpose is to protect the organisation's systems, users and data against cyber threats.

That is why Blue Team activity has a far more continuous character than Red Team activity.

On the Blue Team side there may be many processes, such as;

- monitoring security events,
- SIEM management,
- EDR/XDR operations,
- log analysis,
- threat detection,
- alert management,
- incident response,
- enforcement of security policies,
- endpoint security,
- network security,
- identity security,
- improvement of security controls.

All of these can sit within its remit.

SOC teams are usually an important part of the Blue Team structure as well.

The Blue Team's fundamental question is this:

**“How do we detect and stop an attack aimed at our organisation?”**

### Does an Alert Really Provide Security?

A security product raising an alert does not by itself mean the attack has been detected.

Suppose an EDR solution detects suspicious behaviour.

An alert is generated.

And then what?

Did the SIEM receive that alert?

Was the alert classified at the right severity?

Did the SOC analyst see it?

Was it understood to be part of a real attack?

Was the user account checked?

Was the relevant endpoint isolated?

Was the same behaviour investigated on other systems?

Was the incident response procedure activated?

This is where the Blue Team's real success is measured.

**Detection is not merely generating an alert.**

The detected behaviour must be interpreted and the correct response carried out.

### What Do the Red Team and Blue Team Do Inside the Same Organisation?

Let us consider a controlled scenario.

An organisation is running a Red Team operation.

The Red Team's objective is to see whether access to a critical system can be achieved.

During the operation the Red Team simulates various attacker behaviours in a controlled manner.

The Blue Team, meanwhile, continues running daily security operations.

The Red Team applies an attack technique.

The EDR sees it.

The alert reaches the SIEM.

The SOC analyst examines the alert.

User behaviour is checked.

An investigation is opened on the relevant system.

The Blue Team detects the attack and responds.

In this case the Red Team's failure to reach the objective is not actually a bad outcome for the organisation.

Quite the opposite:

**The defence mechanism worked.**

Measuring exactly that is one of the core purposes of Red Team operations.

### And if the Blue Team Cannot See the Attack?

One of the truly valuable results emerges here.

The Red Team carries out a controlled attack technique.

But;

the EDR raises no alert.

The SIEM cannot correlate the event.

The SOC sees no alert at all.

The attacker behaviour continues unnoticed.

In this case the operation has exposed a significant security visibility problem.

But an important distinction must be drawn here.

The problem may not always lie with the security product.

For example;

the log source may not be forwarded to the SIEM.

The right correlation rule may not exist.

The EDR policy may be misconfigured.

The alert severity may be set too low.

The SOC team may have no use case for that behaviour.

Or the alert may have fired but been missed inside a high volume of alerts.

For this reason Red Team work tests not only attack routes but also **detection engineering** capability.

### What Is Detection Engineering?

Detection engineering is the systematic development of security controls and detection rules for the purpose of identifying attacker behaviour.

Put simply, it seeks an answer to:

**“If this attack technique is used, how would we see it?”**

That is the question it works on.

A given attacker behaviour, for example, may be detectable through;

- Windows Event Log,
- EDR telemetry,
- firewall logs,
- Active Directory records,
- DNS queries,
- proxy records,
- authentication logs.

Any of these sources can carry the evidence.

But collecting that data is not enough on its own.

It has to be made meaningful.

And this is precisely where the Purple Team approach becomes important.

### What Is a Purple Team?

A Purple Team is sometimes imagined as a third, independent team sitting between the Red Team and the Blue Team.

But defining the Purple Team merely as a separate team falls short.

A Purple Team is really a **collaboration model**.

The aim is to bring the Red Team's attack knowledge together with the Blue Team's defensive knowledge.

The Red Team brings this information:

**“We carried out this attack technique in this way.”**

The Blue Team then assesses:

**“We should have seen that behaviour in these log sources.”**

Then, together, the question is asked:

**“Why didn't we see it?”**

Purple Teaming begins right there.

### How Does a Purple Team Work?

Consider a simple example.

The Red Team simulates a particular attack technique under control.

The Blue Team fails to detect it.

In the classic approach the report might simply state:

**“The attack behaviour was not detected by the SOC.”**

In the Purple Team approach the work does not stop there.

First, the traces left by the attack are examined.

Which logs were produced is reviewed.

EDR telemetry is assessed.

SIEM records are inspected.

Existing correlation rules are checked.

A new detection rule is then created.

The Red Team repeats the same attack.

This time the Blue Team sees the alert.

The result:

**The organisation's detection capability for one attack technique has been improved.**

This is one of the most important values of Purple Teaming.

Instead of merely pointing out the problem, it makes the defence better.

### MITRE ATT&CK with Red, Blue and Purple Teams

The MITRE ATT&CK framework can be used to establish a common language across Red Team, Blue Team and Purple Team work.

MITRE ATT&CK classifies attacker behaviour under tactics and techniques.

Attacker behaviour can be assessed, for example, at different stages such as;

#### Initial Access

#### Execution

#### Persistence

#### Privilege Escalation

#### Defense Evasion

#### Credential Access

#### Discovery

#### Lateral Movement

#### Collection

#### Command and Control

#### Exfiltration

These phases give the work a shared structure.

The Red Team can simulate specific ATT&CK techniques.

The Blue Team can assess which of those techniques it was able to detect.

The Purple Team can then improve the areas where detection failed.

In this way a **MITRE ATT&CK detection coverage** view can be produced for the organisation.

### Why Does Detection Coverage Matter?

Having an EDR in an organisation does not mean every endpoint attack is detected.

In the same way, having a SIEM does not mean every attack behaviour is visible.

The truly important question is this:

#### Which attacker behaviours can we genuinely detect?

An organisation might, for example, be able to detect;

70% of initial access techniques,

45% of credential access techniques,

30% of lateral movement techniques,

55% of persistence techniques.

Those figures give a real picture.

In that case the security team can see far more clearly which areas need development.

This approach makes cyber security investments measurable.

### The Red Team Succeeded — Does That Mean the Blue Team Failed?

One of the mistakes frequently made in Red Team operations is treating the exercise as a competition.

#### Red Team vs. Blue Team

That framing may sound appealing.

But from a corporate cyber security perspective the aim is not for the Red Team to beat the Blue Team.

Both teams have the same objective:

**To increase the organisation's cyber resilience.**

The Red Team uncovers attack routes.

The Blue Team works to detect and block attacks.

The Purple Team brings the two bodies of knowledge together and improves the defence.

So an attack the Red Team carried out undetected is an important learning opportunity for the organisation.

Equally, the Blue Team detecting the Red Team at an early stage shows that the security controls are working.

### Are the SOC and the Blue Team the Same Thing?

The terms SOC and Blue Team are often used interchangeably.

But they are not exactly the same.

A SOC – Security Operations Centre – is generally the operational structure that continuously monitors security events and responds to them.

The Blue Team, by contrast, can describe a broader defensive approach.

A Blue Team may contain different security functions such as;

SOC,

incident response,

threat hunting,

detection engineering,

endpoint security,

network security,

identity security.

All of these can sit under the same umbrella.

The SOC can therefore be regarded as one of the important parts of the Blue Team.

### Where Does Threat Hunting Sit in This Structure?

In traditional security operations, teams mostly wait for an alert to appear.

An alert arrives.

The analyst investigates.

If there is an incident, a response follows.

In the threat hunting approach the reverse is done.

The security team acts on this assumption:

**“An attacker may already be inside our systems but may not yet have triggered an alert.”**

Traces of attacker behaviour are then searched for proactively across the systems.

For example;

unusual user behaviour,

unexpected authentications,

suspicious PowerShell activity,

abnormal network connections,

unusual service usage,

unexpected administrator activity

can all be examined.

The information obtained from Red Team operations provides extremely valuable input to threat hunting work.

Because the Blue Team now knows what genuine attacker behaviour looks like inside its own infrastructure.

### A Purple Team Is Not a Product

This is another important misunderstanding about Purple Teaming.

A Purple Team is not a SIEM product.

It is not an EDR product.

It is not an automation platform.

A Purple Team is essentially **a security approach aimed at developing people, process and technology together**.

An organisation may own the most advanced security technologies available.

But if there is no information sharing between the Red Team and the Blue Team, the same attacks may go undetected again and again.

The Purple Team approach aims to break that cycle.

### The Purple Team Cycle

An effective Purple Team engagement can be explained simply through the following cycle:

#### \1. The Threat Is Identified

↓

#### \2. The Attack Technique Is Selected

↓

#### \3. The Red Team Simulates the Technique

↓

#### \4. The Blue Team Measures Detection Capability

↓

#### \5. Logs and Telemetry Are Analysed

↓

#### \6. A Detection Rule Is Developed

↓

#### \7. The Attack Is Simulated Again

↓

#### \8. Detection Is Verified

↓

#### \9. The Process Is Documented

As this cycle is repeated for different MITRE ATT&CK techniques, the organisation's security visibility steadily improves.

### How Does Cyber Threat Intelligence Fit into This Structure?

One of the important sources that makes Red Team, Blue Team and Purple Team work more realistic is **cyber threat intelligence**.

Because in theory there are thousands of different attack techniques.

It is not possible for an organisation to test them all at once.

In that situation this question gains importance:

**“Which techniques do the attackers targeting us actually use?”**

If a particular threat actor targeting the finance sector is known to use;

phishing,

credential theft,

PowerShell,

certain persistence methods,

certain lateral movement techniques,

then the Red Team operation can be shaped around those behaviours.

The Blue Team can develop detections for the same techniques.

Security operations can then be prioritised according to **the organisation's real threat profile** rather than generic threats.

### The Core Difference Between Red Team, Blue Team and Purple Team

If the three concepts had to be summarised in a single sentence each:

#### Red Team: Can we attack?

#### Blue Team: Can we see and stop the attack?

#### Purple Team: Can we be better at the next attack?

When these three questions are asked together, cyber security stops being a structure made up of products.

It turns into a defence model that can be measured and continuously improved.

### Where Should Organisations Begin?

Not every organisation can be expected to sit at the same level of security maturity.

In organisations where the basic security controls are not yet mature enough, foundational areas may need strengthening first, such as;

asset management,

vulnerability management,

log management,

EDR/XDR,

SIEM,

identity and access management,

network segmentation,

regular penetration testing,

incident response processes.

These come before anything else.

In organisations that have reached a certain level of security maturity, Red Team operations allow the defence to be tested against genuine attacker behaviour.

The Purple Team approach then turns the results of those tests into continuous improvement.

### Conclusion: The Aim Is Not to Win, but to Be Better Prepared for the Next Attack

Red Team, Blue Team and Purple Team are not rivals.

They look at different sides of the same security problem.

The Red Team looks through the attacker's eyes.

The Blue Team looks through the defender's eyes.

The Purple Team brings together what both sides have seen.

An organisation's real cyber security maturity cannot be measured by how many security products it uses.

What truly matters is;

**how early it can see the attack,**

**how quickly it can understand it,**

**how effectively it can respond**

and

**whether it can prevent the same attack from succeeding again.**

Because strong defence in cyber security is not only about blocking attacks.

**It is about becoming a harder target after every attack scenario.**