What is a Purple Team penetration test? It should be viewed as a dynamic confluence of Red and Blue Team members with the objective of overcoming communications. 

A Purple Team pentest ought to be viewed of as a dynamic confluence of Red Team and Blue Team members with the objective of surpassing communication obstacles, enabling the transferring of knowledge, and typically arming the Blue Team with freshly practiced skills against a more advanced malicious actor or series of attack situations.  

This blog post by AICorespot makes the claim that Purple Teams ought to make it so that Red Teams imbibe their knowledge to the Blue Team. So, essentially, a “Purple Team Pentest” would be one where that sharing takes place. 

That’s one perspective. Let’s provide you with another perspective. 

If you possess a Red Team that does not provide you the data to the Blue Team, you do not have a Red Team. What you possess is a group of marauders who believe they’re better than everybody and don’t comprehend their literal purpose. 

The term “Red Team” has its origins in the military. The best way to define it is: 

An autonomous group that challenges an enterprise to enhance its effectiveness. 

So if the objective of a Red Team is to enhance the effectiveness of something, what do we believe that this something is? 

It’s the organization they’re evaluating, in other words, the Blue Team. 

These terminologies are getting hijacked and mangled by sales and marketing departments, and it’s beyond time to push back. 

Robust Red Teams share information with their Blue counterparts – that’s their very purpose. Purple teams, if they do exist, should not be permanent while this is being fixed from a prior, broken deployment where no sharing was occurring.  

For a breakdown of differing variants of data security assessments, refer to our previous blog on information security assessments and their variations which was published a few days ago.