Glossary · teams
Purple team: attack, detect, fix, repeat.
In a purple team exercise the attackers (red) and defenders (blue) work together in the open. Red runs a technique, blue checks whether it was caught, and both fix the gap before moving on. You end with better detections, not just a list of findings.
Red, blue and purple
| Team | Role | Ends with |
|---|---|---|
| Red | Attacks, often covertly, toward an objective | Whether the attack was noticed and stopped |
| Blue | Defends: monitoring, detection, response | Alerts, investigations, containment |
| Purple | Red and blue together, technique by technique | Detections that demonstrably fire, mapped to MITRE ATT&CK |
When it’s worth buying
Purple teaming pays off once you have defenders and tools to improve: a security operations team, an EDR or SIEM, or an outsourced monitoring provider. Without them there is nothing for the blue side to tune, and apenetration test is the better first buy.
Exercises are usually organised around MITRE ATT&CK techniques that matter for your industry. Ask a firm which techniques it will run, how detections are verified, and what you keep afterwards: detection rules, playbooks, a heat map of coverage. Firms that offer red teaming are listed in the comparison.
What you should have at the end
- A coverage map: each technique run, marked detected, partly detected or missed, usually laid over the MITRE ATT&CK matrix.
- New or tuned detections written during the exercise, tested again before it ends.
- Response notes: who was alerted, how fast, and what they did, so the playbook can change.
- A shortlist of gaps that need a tool or process change rather than a rule.
If an exercise ends with only a findings list, it was a penetration test with an audience, not a purple team.
Questions
What is a purple team?
A purple team exercise puts attackers (red) and defenders (blue) in the same room: the red side runs a technique, the blue side checks whether it was detected, and together they fix the gap before moving on.
Purple team or red team?
A red team tests whether defenders notice a realistic, covert attack. A purple team is open and collaborative, and aims to improve detections technique by technique. Purple usually comes first; red tests the result.
Do I need a purple team if I have a pentest?
A pentest finds weaknesses to fix. A purple team improves your ability to detect attacks. If you have a security team and monitoring tools, purple teaming is the next step after regular pentests.
Sources for this page
- MITRE ATT&CK — The technique catalogue purple team exercises are usually planned and scored against.
How firms are chosen, what counts as "published" and how to send a correction: methodology.
Cite this page
Pentesting Firms. "Purple team: red and blue working together, and when it beats a pentest." Updated November 8, 2026. https://pentestingfirms.com/glossary/purple-team/