Security Team Colours Explained: Red, Blue, Purple and White

Security exercises borrow their vocabulary from military wargaming, and CompTIA expects you to know which colour does what. The three that matter most are red, blue and purple; white and yellow round out the set.

The teams

Team	Role
Red	Offensive — attacks, emulating an adversary
Blue	Defensive — detects and responds
Purple	Collaboration between red and blue
White	Referees and manages the exercise
Yellow	Builders — developers and architects

Red team

Offensive. Simulates a real adversary to test whether defences actually work, usually with a specific objective — reach the customer database, obtain domain administrator — rather than a list of systems.

The distinction from penetration testing is worth being precise about, because the exam draws it. A penetration test is scoped by systems and aims for breadth: find as many exploitable weaknesses as possible in the agreed scope. A red team engagement is scoped by objective and aims for depth: reach the goal without being stopped, and stealth is part of the test.

A penetration tester who is detected has still done the job. A red teamer who is detected has produced a finding — a good one, for the blue team.

Blue team

Defensive, and it is the standing function rather than an exercise role. Monitoring, detection engineering, incident response, threat hunting, hardening, patching and log analysis.

Blue team work continues whether or not a red team exists. The exercise simply provides a controlled test of it.

Purple team

The one candidates most often misunderstand. Purple is not always a separate team — it is a mode of working in which red and blue share information in real time rather than red operating silently and reporting weeks later.

The value is feedback speed. A red operator runs a technique, asks the SOC whether anything fired, and if nothing did, the detection engineer writes a rule and it is retested within the hour. A traditional red team engagement surfaces the same gap in a report, by which time context is lost.

Exam framing: if a scenario emphasises collaboration and improving detection coverage, it is purple teaming. If it emphasises testing whether defenders notice an unannounced adversary, it is red teaming.

White team

The referees. They define rules of engagement, arbitrate disputes, hold the stop conditions, act as the trusted agents who know the exercise is happening, and score the outcome.

The white team matters in unannounced exercises specifically, because someone must be able to tell the incident response team "stand down, this is a test" before a simulated intrusion triggers a real crisis — or, conversely, confirm that an event is genuine and not part of the exercise. That ambiguity is a real risk in live-fire exercises, and the white team exists to resolve it.

Yellow team

Less commonly examined but increasingly referenced. Yellow is the builders — developers, architects, engineers who construct the systems.

It appears in the derived combinations: orange (yellow plus red) is offensive knowledge informing developers, essentially secure coding education driven by attack findings; green (yellow plus blue) is defenders and builders collaborating so that systems are built to be monitorable and defensible.

The underlying point is that security added after construction is always harder than security designed in, which is the same idea as security by design.

Running an exercise

Authorisation first, in writing, from someone able to grant it. Define the objective, the scope, the permitted and prohibited techniques, and the stop conditions. Decide whether the blue team is informed — unannounced tests measure detection realistically but consume real incident response effort and cause genuine stress. Establish the white team and the escalation path. And agree what happens if the red team finds evidence of a real intrusion, which does occasionally happen.

The output that matters is not a list of what the red team achieved. It is, for each technique attempted: was it prevented, detected but not alerted, alerted, or missed entirely. That four-way result is what improves the defence.

What to remember

Red attacks, blue defends, purple is red and blue working together with live feedback, white referees the exercise, yellow builds. Penetration testing is scoped by systems and seeks breadth; red teaming is scoped by objective and includes stealth. Purple teaming shortens the feedback loop between an attack technique and a working detection.

Related reading: Adversary emulation · Penetration testing methodologies · SOW and rules of engagement