Red Team vs. Penetration Testing vs. Purple Team: What Actually Sets Them Apart

"Red team" gets thrown around loosely — sometimes a two-week check with a fancier invoice, sometimes a genuine months-long attack simulation. "Purple team" gets mentioned even less, usually as an afterthought, which is a shame since it's often the one that fixes problems fastest.

Think of it this way: a penetration test checks whether your doors and windows lock properly. A red team hires someone to actually try to break in — quietly, without telling the homeowner — to see if anyone notices. A purple team is you and a security expert standing in the house together, testing locks one by one, fixing the weak ones on the spot.

I've watched a mid-size company burn six figures on a red team engagement before their security team could reliably catch a well-known hacking tool. The report confirmed what they already suspected, just with nicer charts. A purple team exercise would've told them the same thing — cheaper, faster, with the problems already fixed.

Penetration Testing: Checking the Locks

A pen test asks one question: can someone break into this specific thing, and how? "This specific thing" is usually a website, an app, or a piece of company network — whatever's in the contract.

Testers follow a fairly standard process: look for weak spots, exploit them, write it up, using playbooks like OWASP's testing guide or NIST SP 800-115. The engagement runs one to three weeks, and your IT team already knows it's happening — no surprise involved.

What a pen test is genuinely good at is chaining small issues into something serious — three unremarkable findings combined into full system access. You walk away with a report: findings, severity, proof they're real, and steps to fix them.

Red Teaming: Would Anyone Actually Notice?

Red teaming asks a different question: if a patient, skilled attacker came after us for real, would anyone notice before serious damage was done?

It's not about finding every unlocked window — it's about reaching one specific goal the way a real attacker would: phishing, slow lateral movement, deliberately avoiding anything that trips an alarm. Engagements run four to twelve weeks, because rushing defeats the point.

Here's what surprises people: your own security team doesn't know it's happening. Only one or two trusted people are read in, mainly for legal cover. That secrecy is the only way to find out honestly whether your team would catch a real attack.

You don't get a checklist — you get a story: how they got in, how long they went unnoticed, and where things fell apart.

Purple Teaming: Fixing Problems Together

Purple teaming is a different way of working. Attackers and defenders work side by side, in the same session. The offensive side runs one technique — say, a common way to steal passwords from memory — while the defensive side watches their monitoring tools live. If nothing gets flagged, they don't wait for a report. They pause, figure out why, fix it, and re-run the technique to confirm it now gets caught.

That instant loop — test, diagnose, fix, retest — is the entire value. No gap between finding a problem and closing it.

Case Study: A Mid-Size Healthcare Company

Here's how this played out at a real organization. The details are anonymized and numbers are rounded.

The setup: A healthcare tech company, around 800 employees, handling records for 40 hospital systems. HIPAA required annual pen testing. A five-person security team ran a SIEM deployed 18 months earlier, mostly on default vendor rules — never tuned.

Pen test: Their scheduled test found 14 issues, three critical — including an auth bypass in the patient portal that, chained with an over-permissioned API key, would let an attacker pull any patient's records without logging in. Fixed in eight days. Audit satisfied.

Purple team: The CISO didn't stop there. A purple team ran six ATT&CK techniques matching what ransomware groups were actively using against healthcare that quarter. The SOC caught two of six. Phishing landed in 4 of 15 inboxes undetected. Credential dumping ran clean — the EDR was set to "detect" instead of "block and alert," a one-checkbox misconfiguration nobody had caught. Lateral movement via RDP generated zero logs, since logging wasn't enabled on that VLAN.

Each gap got fixed and re-tested within the same two-day engagement — the phishing rule then caught 14 of 15 on a second pass.

Total cost: roughly a fifth of a red team engagement.

Red team, five months later: With detection demonstrably improved, the company ran a red team engagement to reach the patient database undetected. The team got in through a contractor's misconfigured VPN access — unscoped by either prior test — and reached a jump box before the newly tuned lateral-movement alerts flagged it.

Skipping the purple team step would have meant walking into the red team with the same blind spots that let lateral movement go completely unlogged — the red team would've found that gap too, just five months later, for roughly five times the price.

The Differences, Side by Side

Which One Do You Actually Need?

They aren't competitors — they build on each other. Pen test first, to fix the obvious stuff. Purple team next, fixing problems the moment you find them. Red team last, once you have a security team worth testing — jump to it too early and you'll pay a premium to learn what purple teaming would've told you for less, as the case study shows.

A penetration test tells you where the locks are weak. A red team tells you whether anyone notices someone walking through the door. A purple team makes sure the next real attack gets caught and that your team knows exactly what caught it.

FAQs