Roles
What is Red team?
A team that plays the attacker against its own organisation to test defences, while the blue team defends and learns.
A red team emulates a real adversary against its own organisation, with permission, to test how well people, processes and technology detect and respond. Unlike a narrow penetration test, a red team exercise usually has a goal, such as reaching a sensitive system, and uses realistic tradecraft.
The blue team defends. A purple team exercise has both sides working together openly, so each attacker step is checked against what the defenders saw. Threat intelligence supplies the TTPs that make the emulation realistic.