Red Team / Blue Team / Purple Team

Why it matters

A red-team report that lands on a shelf changes nothing. Purple teaming exists because the useful output of an attack simulation is not "we got in" — it is "here is exactly which of your detections fired, and which did not". That only works if the two sides compare notes technique by technique instead of red team writing a report and walking away.

The terms come from military exercises. In practice: a red team emulates a real adversary against production, usually with objectives (reach the payment system) rather than a scope list, over weeks, with the blue team not warned — which is what separates it from a penetration test. The blue team is the SOC, detection engineering and incident response. Purple is not a third team; it is a mode of working where the two sit together.

How a purple-team session works

A session is structured around a shared technique list: pick a MITRE ATT&CK technique, red team executes it (or a safe emulation of it), blue team checks whether it fired an alert, and if it did not, blue team writes the missing detection on the spot — then red team re-runs it to confirm the fix actually works. The loop is technique-by-technique, not one big engagement report at the end. The output is a coverage table: for each technique, logged? detected? alerted? responded?, before and after.

Two things keep it honest. Emulate the procedure an actual actor uses (see TTP), not a textbook version — a detection that fires on the Atomic Red Team test but not on the real tooling is a false sense of coverage. And keep the exercise scoped and logged so the SOC can tell the exercise from an incident afterwards.

Common misreadings

• Pentest ≠ red team. A pentest enumerates vulnerabilities in a scope; a red team pursues an objective by any technique, with stealth. Buying one when you need the other is the most common procurement mistake.
• Purple is not "red team with the answers". If red only runs what blue already detects, the exercise validates nothing. The technique list should come from a threat profile, not from the rule catalogue.
• "We passed" is not an outcome. The outcome is the delta in the coverage table and the tickets that closed it.

Related terms

• MITRE ATT&CK — MITRE ATT&CK is a public, curated catalogue of the behaviours real attackers use, organised so defenders can say "we saw T1059.001" instead of "some PowerShell thing".
• Kill Chain — The Cyber Kill Chain is a seven-stage model of an intrusion's lifecycle — Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command & Control, Actions on Objectives — published by Lockheed Martin in 2011 to frame where in the chain to break an attack.
• TTP — TTPs are the three levels at which attacker behaviour is described — the tactic is why (steal credentials), the technique is how (dump LSASS memory), the procedure is exactly how this actor does it (procdump renamed to dump64.exe, run via a scheduled task).
• IOA — An IOA describes what an attacker is doing rather than what they left behind — a sequence of actions such as "a document opens a shell that downloads and executes a file" — so it detects the technique regardless of which hash, IP or domain is used this time.