Red team vs blue team
Short answer: The red team tests the organization as an adversary would: objective first, not a closed list of IPs. The blue team watches, detects and responds. Coordinating them (purple team) stops offence and defence working with their backs to each other.
Definition
Red team and blue team are confused with generic “ethical hacking”. They ask different questions. The red team takes the attacker’s mindset to find paths and blind spots (pentest, pivoting, threat emulation) without turning the exercise into a real incident. The blue team analyses, monitors and responds: anomalous patterns, malware, forensics, plans for phishing or ransomware. A purple team replaces neither: it gets offensive findings into defence, and lets defence inform the next exercise.
What the red team does
It starts from an objective, not only from a list of IPs. It can combine reconnaissance, exploitation and lateral movement to see whether controls survive a chained attack, not a single finding.
A pentest of one application remains useful: it goes deep on one system. The red team also asks which path an attacker would use when the perimeter is not the one on the diagram.
What the blue team does
It defends: it monitors networks and systems, investigates what falls outside the pattern, and responds when the incident is real. It designs how to act against different kinds of attack; it is not only an offensive report.
Without a map of what is exposed and without rehearsal, defence works on the perimeter it thinks it has. The red team does not replace that function; it tests it.
The purple team
It coordinates offence and defence so they neither collide nor ignore each other. The value is not a third colour: it is that a finding becomes a control, and a control is tested again.
Without that coordination, the red team delivers a PDF and the blue team stays with the alert queue. The exercise does not change exposure.
In the Azuba model
Offensive Security & Exposure Management treats attack surface and continuous pentesting as capabilities distinct from a deep validation of one application or network.
In Offensive Security & Exposure Management, FireCompass covers surface, ASM and continuous pentesting with CART.
Continue
Is an annual pentest a red team?
Not necessarily. A pentest usually scopes known systems. A red team starts from an objective and can discover surface that was not in scope. They can complement each other.
Do we have to staff all three teams?
We do not claim that. Offence, defence and coordination are functions. How they are covered (in-house, a service or technology) is assessed in each environment.