Cyberpediaby Brain
ENDEFR

Pentest, Red Team, Blue Team and Purple Team

Penetration test, simulated attack exercise, defence teams: what these terms mean and what to do if you see suspicious behaviour.

In 30 seconds

Where it happens
In your mailbox or on your computer, when something is out of the ordinary, whether or not a test has been announced.
What the attacker wants
In a penetration test, the tester uses the same tools and techniques as an adversary to check how solid a system is1.
The reflex
Quickly report to support or the SOC whatever looks suspicious, without telling the presumed author and without switching off the computer until you are asked to.
If it is already done
Say precisely what you saw, at what time, and what you clicked or typed.

What it is

In a company, you hear about pentests, Red Teams, Blue Teams or Purple Teams. These words describe testing and defence activities carried out by specialists. For an employee, they mainly serve one purpose: knowing that strange behaviour on your computer or in your mailbox can come from an authorised exercise, from a real attack, or from a simple breakdown, and that in all three cases it must be reported.

The sources gathered for this article describe penetration testing and incident management precisely. They do not define the terms Red Team, Blue Team and Purple Team. The article therefore sticks to what these sources say, and attributes nothing more to them.

Straight answers

What is a pentest?

The UK's NCSC defines it as a method for gaining assurance in the security of an IT system by trying to breach some or all of its security, using the tools and techniques an adversary might use1. It compares it to a financial audit: the internal team tracks spending day to day, and an external audit checks that its procedures are sufficient1.

NIST, for its part, publishes a technical guide on planning and conducting security tests, analysing the findings and developing mitigation strategies. Among the uses it lists: finding vulnerabilities in a system or network, and checking compliance with a security policy2.

What do the Red Team, the Blue Team and the Purple Team do?

None of the sources cited here defines these three names. What the NCSC describes is a scenario-based test that also aims to measure the organisation's ability to detect and respond, in order to learn how effective it is and how far it extends in a given scenario1. On the employee side, detection is what concerns you: your report is part of it.

Two MITRE knowledge bases serve as common reference points. ATT&CK records adversary tactics and techniques drawn from real-world observations7. D3FEND is a knowledge graph of cybersecurity countermeasures8.

Can a test disrupt my work?

The NCSC writes that testers must avoid disrupting the system being tested, but that it is impossible to guarantee that no unexpected reaction will occur1. A slowdown or odd behaviour can therefore occur during a test. If in doubt, report it to support or the SOC.

Why does my report matter?

Reporting is a step in detection. The NCSC presents incident management as a five-stage cycle taken from NIST: identify, protect, detect, respond, recover3. Its collection of guidance places detection and notification among the basic issues of incident response3. NIST points out that a response capability serves to detect incidents quickly, limit loss and destruction, fix the weaknesses that were exploited, and restore services5.

1How it works1 min

A penetration test generally follows a five-step pattern: contact, scoping, testing, report and follow-up. The problems found are given a severity level1. Scoping sets the technical limits, the types of test expected and the schedule1. The report lists the vulnerabilities, the risk level of each and a way to fix them1.

Testers may or may not know the system in advance. In a black-box test, no internal information is given to them: the test is done from the outside and better reproduces the risk coming from attackers unknown to the organisation1. In a white-box test, they have all the information about the target1. The NCSC adds that the knowledge of the test given to administrators also varies from one test to another1. A pentest has limits. It only validates the absence of known vulnerabilities on the day of the test, and a year or more can pass between two tests1. Detection by employees and by the security team therefore remains useful between two tests.

Next comes incident response. NIST published revision 3 of its guide in April 2025, which places incident response within the overall risk management described by Cybersecurity Framework 2.046. It aims to better prepare responses, reduce the number and impact of incidents, and improve detection, response and recovery6.

2What you do1 min

The following text is practical advice, not a fact drawn from a source: your company's procedure always takes precedence.

  • Report as soon as something seems abnormal. Go through support or the SOC, depending on what your company indicates.
  • Describe the facts: time, what was displayed, what you opened or typed. A detail that looks minor can help the team link several signals.
  • Do not reply to the sender of a suspicious message and do not confront the person whose action you suspect.
  • Do not switch off the computer until you are asked to, and wait for instructions from support or the SOC.
  • If you later learn that it was an exercise, the report was not useless: it made the detection chain work.
3Pitfalls1 min

Believing that an exercise is a real attack, or the reverse. Since testers may have received no internal information and the level of knowledge of the test among administrators varies1, the difference is not necessarily visible from your computer. Report in both situations.

Not reporting for fear of being blamed. The NCSC starts from the principle that incidents can and will happen, and that preparation is what helps to handle them well3.

Reporting too late. NIST describes the aim of a response capability as detecting incidents quickly and limiting loss5.

Thinking that security rests on the testers. The NCSC states that risk assessment and remediation decisions remain the organisation's responsibility, and that reducing risk is a business process that should not be handed entirely to the test team1.

Fact sheet

Identifier
CP-247
Wing
3. Protocols and defence
Brain skill
Incident Reporting & Response (report_incidents)
Brain reflex
cr-014
Diagram
G4 · Incident Timeline & Containment
Languages
de, en, fr
Sources
8 sources checked on 3 November 2026
Sources8 sources
  1. NCSC (UK), “Penetration testing”, 8 August 2017. https://www.ncsc.gov.uk/guidance/penetration-testing (accessed 3 November 2026)
  2. NIST, “Technical Guide to Information Security Testing and Assessment”. https://csrc.nist.gov/pubs/sp/800/115/final (accessed 3 November 2026)
  3. NCSC (UK), “Incident management”, 19 September 2019. https://www.ncsc.gov.uk/collection/incident-management (accessed 3 November 2026)
  4. NIST, “Cybersecurity Framework”. https://www.nist.gov/cyberframework (accessed 3 November 2026)
  5. NIST, “Computer Security Incident Handling Guide”, 6 August 2012. https://www.nist.gov/publications/computer-security-incident-handling-guide (accessed 3 November 2026)
  6. NIST, “Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile”. https://csrc.nist.gov/pubs/sp/800/61/r3/final (accessed 3 November 2026)
  7. MITRE ATT&CK, “MITRE ATT&CK®”. https://attack.mitre.org/ (accessed 3 November 2026)
  8. MITRE, “MITRE D3FEND Knowledge Graph”. https://d3fend.mitre.org/ (accessed 3 November 2026)

Cite this article

Brain, “Pentest, Red Team, Blue Team and Purple Team”, Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/pentest-red-blue-purple-team/

BibTeX 
@misc{brain_cp247_en_2026,
  author = {Brain},
  title = {Pentest, Red Team, Blue Team and Purple Team},
  year = {2026},
  howpublished = {Cyberpedia},
  url = {https://startbrain.io/cyberpedia/en/articles/pentest-red-blue-purple-team/},
  note = {CC BY 4.0}
}
CC BY 4.0 licence