Color teams are the oldest trick in security operations and still the most misunderstood. Red is not "people who hack." Blue is not "people who respond." Purple is not "red + blue in a meeting." Each has a distinct job, and the gap between them is where real incidents live.

Red: adversarial, goal-oriented, scoped

Red's job is to prove — through action, not opinion — that a specific outcome is reachable by someone who does not work for you. "Reachable" has to be operationally defined: "can an external attacker, starting with only public information, obtain read access to the DD case database within 5 business days?" That is a red-team question. "Is our password policy strong?" is not.

Red succeeds when it delivers an artifact: a screenshot, a captured credential, a written exploit, with a reproducible chain. The deliverable is the chain, not the finding. A finding without a chain is a suggestion. A chain is evidence.

Blue: boring, continuous, evidence-driven

Blue's job is the opposite: make the artifacts red would produce impossible or detectable. The boring parts — patch management, log retention, alert tuning, remediation tracking — are 80% of blue work and 0% of security marketing. Blue is also the team that owns threat assessment: the model of what is at risk, who would want it, and how they would get it.

Blue succeeds when it can produce detection telemetry for every stage of a red chain — or, better, when it prevents the stage entirely.

Purple: the loop that makes the other two matter

Purple is not a team in the org chart. It is a workflow. Red finds a chain. Purple walks the chain with blue, one stage at a time, and asks "what would have caught this at stage 3?" The answer is a detection, an alert, a block, or a playbook. Purple closes the gap and walks the chain again, next month, to verify the closure.

Without purple, red's findings land in a report. With purple, they land in the detection stack.

Why you need all three

Red only — you find holes but do not close them. Your threat posture is a list of problems.
Blue only — you close the holes you already know about. Your threat posture is a hope that the next attacker is not creative.
Red + blue, no purple — findings exist but never become detections. The same chain works twice.
All three — the loop closes. Each red iteration makes the next one harder.

Penetration testing is not red teaming

Pen tests are scoped to a system. Red teams are scoped to an outcome. A pen test of the DD API asks "are the endpoints correctly authenticated?" A red team asks "can I get to the DD data?" The second question finds chains the first one does not see because chains cross system boundaries.

Where to go next

Academy: Color Team Security — the full workflow
Glossary: Red Team, Security Operations, Penetration Testing, Threat Assessment, Remediation

Three colors. One loop. Drop any color and the loop breaks.

Color Team Operations: Red, Blue, Purple, and Why You Need All Three