# Red team and blue team

> Hired attackers who play the real enemy, and the defenders who try to catch them.

- Level: Intermediate
- Topics: Security
- URL: https://tidbit.legios.com.ar/red-team-and-blue-team/
- In Spanish: [Red team y blue team](https://tidbit.legios.com.ar/es/red-team-and-blue-team/)

The names come from military war games, where one side played the enemy. In security, a **red team** is a group allowed to attack its own organization the way a real adversary would. It gets a goal, such as reaching the payroll database or the CEO's email, and can use any realistic path to get there: phishing emails, phone calls to the help desk, a borrowed badge to walk into the office, a forgotten server with a known vulnerability.

The **blue team** is the defense: the people who watch the alerts, run the security operations center, investigate odd logins and respond to incidents. During a red team exercise the blue team often does not know an attack is happening, because the point is to test whether real defenses detect and stop it, not just whether holes exist.

That is the difference with a penetration test, which usually tries to find as many weaknesses as possible in a defined system within a short window. A red team exercise is narrower and stealthier, and it measures people and processes as much as technology. When both teams sit down together to replay each step, fix the gaps and improve detection, it is called **purple teaming**. The term red teaming is also used for AI: people deliberately try to make a model misbehave so the problems can be fixed before launch.

## An analogy

A football club where one squad plays as next Sunday's rival, copying its tactics, so the starting team can practice defending against them. The scrimmage only helps if both sides talk afterwards.

## Keep in mind

- Red team: authorized attackers with a goal who imitate a real adversary.
- Blue team: the defenders who detect, investigate and respond.
- Unlike a pentest, a red team tests detection and response, not only flaws.
- Purple teaming: both sides working together to close the gaps.

## Go deeper

- [Red team on Wikipedia](https://en.wikipedia.org/wiki/Red_team)
- [Blue team (computer security) on Wikipedia](https://en.wikipedia.org/wiki/Blue_team_(computer_security))
- [What is red teaming? (IBM)](https://www.ibm.com/think/topics/red-teaming)

## Related terms

- [Database](https://tidbit.legios.com.ar/database/): An organized store of data that programs can search and update safely.
- [Phishing](https://tidbit.legios.com.ar/phishing/): A fake message that tricks you into handing over a password or a payment.
- [Server](https://tidbit.legios.com.ar/server/): A computer whose job is to answer requests from other computers, all day, every day.
- [Vulnerability and CVE](https://tidbit.legios.com.ar/vulnerability-and-cve/): A flaw that lets an attacker misuse software, and the public id that names it.
- [Security operations center](https://tidbit.legios.com.ar/security-operations-center/): The team that watches an organization's systems around the clock for attacks.
- [Penetration testing](https://tidbit.legios.com.ar/penetration-testing/): Hiring someone to break into your systems, with permission, before a criminal does.
- [Artificial intelligence](https://tidbit.legios.com.ar/artificial-intelligence/): Getting computers to do things that, until recently, only people could do.