What is the difference between a red team and a blue team?

A red team attacks: it emulates a real adversary to reach an agreed objective and records where defence could have stopped it. A blue team defends: it monitors, detects, investigates and contains. In an exercise the red team's activity is the test input and the blue team's detection and response is what gets measured.

Should the blue team know a red team exercise is running?

For a measurement of real detection capability, no: an unannounced exercise shows what your defenders catch under normal conditions. A small white cell inside the organisation always knows, so that deconfliction and safety decisions can be made. Announced exercises suit training and the replay phase.

What is a white cell in a red team exercise?

The white cell is the small trusted group inside the organisation that knows about the exercise, approves the scenarios, handles deconfliction with the blue team and can halt the operation. TIBER-EU calls it the white team and the DORA technical standards on TLPT call it the control team.

What is deconfliction?

Deconfliction is the agreed procedure for confirming quickly, through the white cell, whether something the blue team has detected belongs to the red team or to a real attacker. It exists so that a genuine intrusion is never dismissed as part of the test.

What should the blue team receive after a red team exercise?

A timestamped attack timeline, every detection that fired and every action that should have produced one but did not, a MITRE ATT&CK mapping of the techniques used, the indicators involved, prioritised detection and hardening recommendations, and a replay session in which both teams walk through the attack together.

Do we need a blue team before we can run a red team exercise?

You need someone whose detection and response you are measuring, otherwise the exercise is a long penetration test. That can be an in-house SOC, a managed detection and response provider or a hybrid. If you have none yet, start with a purple team engagement or a penetration test and build the blue team first.

Is a red/blue exercise required under NIS2 or DORA?

NIS2 requires incident handling (Article 21(2)(b)) and assessment of the effectiveness of your measures (Article 21(2)(f)) without prescribing a method; a red/blue exercise is the most direct evidence for both. DORA goes further: designated financial entities must run threat-led penetration testing at least every three years (Articles 26 and 27), which is a red/blue exercise under the TIBER-EU method.

1 November 2026 · 10 min read · By Michael van Mameren, Lead Penetration Tester (OSCP)

Red Team vs Blue Team: What Each Side Does, How an Exercise Runs and What the Defenders Should Get Out of It

The red team attacks, the blue team defends. What matters to a CISO is the part that follows: how the two are set against each other in a controlled exercise, how you keep a simulated attack from colliding with a real one, and what the blue team must receive afterwards to actually get better.

Discuss a red/blue exercise

Red team and blue team: the definitions

A red team is a group of offensive security specialists who emulate a real adversary against an organisation to test whether its people, processes and technology can prevent, detect and respond to an attack. A blue team is the defensive function: the analysts, engineers and responders who monitor the environment, triage alerts, investigate incidents and contain them. The terms come from military wargaming, where a red force plays the opponent and a blue force plays the home side.

The two are not rivals. They are two halves of one assurance question: if a capable attacker came for us, how far would they get, and how quickly would we know? The red team answers the first half by trying. The blue team answers the second half by being measured while the red team tries. A red team exercise without a blue team is a long penetration test. A blue team without a red team has never been tested against anything but its own assumptions.

This article covers red team/blue team exercises themselves. What red teaming is as a discipline, and how it differs from a penetration test, are covered in two separate articles linked at the bottom of this page.

A third term you will meet is purple teaming: the collaborative form of the same work, in which red and blue sit together, run techniques one by one, check after each whether detection fired and tune on the spot. It is a working mode rather than a third team, the natural follow-up to an unannounced exercise once the gaps are known, and the right starting point for organisations whose blue team is too young to be measured fairly against a covert adversary. Our separate article on purple teaming, linked below, explains how such an engagement is structured.

Red team vs blue team side by side

Same organisation, same attack, two completely different jobs. The table shows where they diverge in goal, mindset, skills, tooling, output and how each is measured.

Dimension	Red team	Blue team
Goal	Reach an agreed business objective the way a real adversary would, and record every point where defence could have stopped it	Prevent the compromise where possible, detect it where not, and contain it before the objective is reached
Mindset	Opportunistic and patient: find the one path that works, avoid attention, prove impact	Systematic and vigilant: cover every path, separate signal from noise, act under uncertainty
Core skills	Initial access, identity and Active Directory abuse, lateral movement, command and control at concept level, social engineering, physical intrusion, reporting	Log analysis, detection engineering, threat hunting, forensics, incident response, threat intelligence, hardening
Tooling (concept level)	Reconnaissance and OSINT tooling, phishing infrastructure, a command-and-control framework	SIEM, EDR/XDR, NDR, identity protection, SOAR playbooks, threat-intelligence feeds
Reference framework	MITRE ATT&CK for technique mapping, TIBER-EU for regulated engagements, PTES and NIST SP 800-115 for method	MITRE ATT&CK and D3FEND for coverage, NIST SP 800-61 Rev. 3 for incident handling
Primary output	Attack narrative, timeline, objectives achieved, detections triggered and missed, remediation and detection recommendations	Alerts, cases, containment actions, incident reports, tuned detections, lessons learned
KPIs	Objectives reached, time to objective, detections triggered on the way, quality of the replay for the defenders	Mean time to detect (MTTD), mean time to respond (MTTR), ATT&CK coverage, false-positive rate, dwell time

How red team/blue team exercises actually run

The value of a red/blue exercise lies in the ground rules. These six decisions decide whether you measure your real detection capability or something else.

Announced or unannounced

Unannounced, the blue team does not know a red team is active, so you measure genuine detection and response under normal conditions. Announced, the defenders know the window and the result shifts towards training value. Mature organisations run unannounced for the assessment and announced for the replay.

The white cell

A small trusted group inside the organisation, typically the CISO and one or two leads, knows about the exercise. TIBER-EU calls this the white team; the DORA technical standards speak of a control team. It approves scenarios, authorises escalations and is the only party that may call a halt.

Deconfliction

The pre-agreed procedure for the white cell to confirm, within minutes, whether an action the blue team has detected belongs to the red team or to a real intruder. Without it, a real attack can be waved through as 'probably the test', the single most dangerous failure mode of a red/blue exercise.

Objectives and rules of engagement

The exercise is scoped around business objectives ('reach the payment system', 'read the board's mailbox', 'obtain domain-wide privilege') rather than a list of hosts. The rules of engagement fix what is out of bounds, which hours apply, how data is handled as proof of access, and the escalation chain.

Duration and tempo

A red/blue exercise runs for weeks, not days, because the tempo is set by the adversary being emulated. Slow, low-noise operations test whether the blue team catches subtle signals; a deliberately noisier phase at the end tests whether obvious signals are acted on.

Stop conditions and safety

Agreed in advance: which systems are never touched, which actions require a go from the white cell, how production impact is avoided, and what happens if the red team finds evidence of a real compromise (the exercise pauses and incident response takes over).

What the blue team should receive after the exercise

The blue team only improves if the red team hands over its work in a form the defenders can act on. A report with findings alone is a penetration test report, not a red/blue result. Demand the following.

A full attack timeline, timestamped to the minute, from first reconnaissance to the final objective, so the blue team can line it up against its own logs and alerts
Every detection that fired, with what the blue team did with it, next to every action that should have produced a detection and did not
A MITRE ATT&CK mapping of each technique used, so detection gaps become coverage gaps rather than anecdotes
The indicators used during the exercise (domains, infrastructure, file names, accounts), so defenders can verify what their tooling saw and tune on it
A separation between prevention failures (a control should have blocked this), detection failures (a control should have alerted) and response failures (an alert existed but was not acted on in time)
Prioritised recommendations split into detection engineering, hardening and process, each tied to a point on the timeline
A replay session in which the red team walks the blue team through the attack step by step and the blue team shows what it saw. This is where most of the learning happens

Building a blue team: in-house SOC, MDR or a hybrid

Most organisations do not have a blue team at their first red/blue exercise; they have a few IT staff who watch alerts. These are the three realistic ways to build one, and what an exercise measures in each case.

In-house security operations centre (SOC)

Your own analysts, tooling and detection engineering. Highest control and the deepest knowledge of your environment, but 24/7 coverage needs eight to ten people across shifts and retention is hard. An exercise against an in-house SOC measures the whole chain, from log sources to the on-call phone.

Managed detection and response (MDR)

An external provider monitors endpoints, identity and network around the clock and acts on alerts under an agreed mandate. The fastest route to a functioning blue team for organisations between a few hundred and a few thousand staff. An exercise against an MDR provider is also a vendor test: does the service detect and escalate what the contract says? Our managed detection and response service is built to be tested this way.

Hybrid: internal lead, external operations

A small internal team owns detection strategy, risk context and the business relationship, while a provider runs the 24/7 monitoring. Most mid-sized European organisations converge on this model. In an exercise the interesting measurement is the handoff: did the provider escalate, and did the internal team act within the agreed time?

Red/blue exercises for NIS2 and DORA

NIS2 does not use the words red team or blue team, but two requirements map directly onto them. Article 21(2)(b) requires incident handling, and Article 21(2)(f) requires policies and procedures to assess the effectiveness of your cybersecurity risk-management measures. A red/blue exercise is the most direct evidence for both: it tests the incident-handling chain end to end and documents, with timestamps, how effective the detection measures were. It also rehearses the Article 23 reporting clock, because it shows whether your team would have known about a significant incident in time to issue the 24-hour early warning.

Under DORA, financial entities designated by their supervisor must run threat-led penetration testing (TLPT) at least every three years under Articles 26 and 27, following the TIBER-EU method (TIBER-NL under De Nederlandsche Bank in the Netherlands). TLPT is a red/blue exercise in a regulatory wrapper: unannounced, on production, with a control team inside the entity, an external threat-intelligence provider and a closure phase in which red and blue replay the attack together. Every red/blue exercise you run before a TLPT is preparation for it; our DORA article explains the obligation in detail.

For other sectors the logic is the same: ISO/IEC 27001:2022 controls A.5.26 (response to information security incidents) and A.8.16 (monitoring activities) are easiest to evidence with an exercise record, and baselines such as BIO 2.0 for Dutch government and NEN 7510:2024 for healthcare expect demonstrable incident response capability rather than a policy document.

The career angle, and how HackersHub runs the red side

Red team work rewards patience, creativity and deep knowledge of how Windows, identity and networks actually behave; it is project-based and the feedback is immediate. Blue team work rewards rigour, breadth and calm under pressure; it is continuous and the feedback is slower but the impact is daily. The strongest practitioners on either side have spent time on the other, which is why experienced red teamers make good detection engineers. We describe the red side of that career in our article on what a red teamer does.

HackersHub runs the red side of red/blue exercises for organisations in the Netherlands, the wider EU and the US, with 10+ years of offensive security expertise and a team in which every operator holds at least OSCP, alongside OSWE and CREST-certified specialists. Every exercise is scoped around business objectives, run under written rules of engagement with a white cell and a deconfliction procedure, mapped to MITRE ATT&CK and closed with a replay session for your blue team. Where you do not yet have a blue team, our managed detection and response service can provide one, and we keep the two engagements separate so the measurement stays honest.

Frequently asked questions

Ready to test your blue team against a real adversary?

We scope red/blue exercises around your business objectives, run them under a white cell with a deconfliction procedure, and close with a replay your defenders can build on. Talk to an expert.

Scope a red team exercise Schedule a call