Red team and blue team

The names come from military war games, where one side played the enemy. In security, a red team is a group allowed to attack its own organization the way a real adversary would. It gets a goal, such as reaching the payroll database or the CEO's email, and can use any realistic path to get there: phishing emails, phone calls to the help desk, a borrowed badge to walk into the office, a forgotten server with a known vulnerability.

The blue team is the defense: the people who watch the alerts, run the security operations center, investigate odd logins and respond to incidents. During a red team exercise the blue team often does not know an attack is happening, because the point is to test whether real defenses detect and stop it, not just whether holes exist.

That is the difference with a penetration test, which usually tries to find as many weaknesses as possible in a defined system within a short window. A red team exercise is narrower and stealthier, and it measures people and processes as much as technology. When both teams sit down together to replay each step, fix the gaps and improve detection, it is called purple teaming. The term red teaming is also used for AI: people deliberately try to make a model misbehave so the problems can be fixed before launch.