The colours are borrowed from military exercises. Red attacks, blue defends, and purple is what happens when you stop treating it as a competition.
The distinctions matter commercially, because organizations regularly buy the wrong one.
Blue Team
Everyone whose job is to defend: monitoring, detection, response, hardening, patching, and architecture. It is the largest group by headcount and where most security jobs are.
The work is covered across our blue team section, from the SOC through detection engineering and incident response.
Red Team, and How It Differs From a Pentest
A penetration test aims for coverage. Find as many real weaknesses as possible in the scope, in the time available, and report them.
A red team engagement aims for an objective. Get to the customer database, or the payment system, or domain administrator, without being caught. It is quiet, it usually takes longer, and it typically has a much narrower report.
The key difference is what is being tested. A pentest tests your prevention. A red team engagement tests your detection and response, because the whole point is finding out whether anyone notices.
Because of that, red team engagements are usually only worth buying once the basics are in place. If you already know your patching is behind and you have no central logging, you do not need to pay someone to prove nobody would notice an intrusion.
Adversary Emulation
A variation on red teaming where the team deliberately imitates a specific known threat group, using that group's documented techniques rather than whatever is most effective.
The point is relevance. If your industry is targeted by a particular group, testing against the techniques that group actually uses is more informative than testing against generic ones. This is where MITRE ATT&CK is used most directly, and MITRE publishes emulation plans for specific groups.
Purple Team
Purple is not a third team, it is a way of working. Red and blue in the same room, or at least the same call, running techniques and checking together whether anything fired.
The loop is short by design. Red runs a technique. Blue looks. If nothing fired, they work out why: was the log source missing, was the rule wrong, was the alert generated and lost in the queue. Then they fix it and run it again.
The output is improved detection rather than a report. For most organizations this produces more value per dollar than a traditional red team engagement, because it fixes things during the exercise instead of afterwards.
What About the Other Colours
You will occasionally see yellow for builders and developers, orange for the interaction between yellow and red, and green for the interaction between yellow and blue, in what gets called the security colour wheel.
It is a reasonable idea and mostly used in training material rather than in job titles. Nobody is hiring an orange team.
Which One Should You Buy
If you do not have asset inventory, patching, central logging, and endpoint detection, buy none of them yet. Fix that first. An attack simulation against an environment with no visibility produces a report that says nobody saw anything, which you already knew.
If you have the basics and want to know what is exploitable, buy a penetration test.
If you have a SOC and want to know whether it works, run purple team exercises. They are cheaper and produce faster improvement.
If you are mature, regulated, or believe you are specifically targeted, a red team engagement or adversary emulation answers questions the others cannot.
For Your Own Career
Most people are better served by understanding both sides than by picking one early. Defenders who have never run an attack write detections against imagined behavior. Attackers who have never watched an alert queue produce findings that are technically correct and operationally useless.
That is why the mentorship covers both, and why Week 10 deliberately makes you do both in the same exercise.
Learn This at HackRange
Week 10 of the mentorship runs a purple team exercise against detections you wrote yourself in Week 9.