What is a red team?
A red team is a group of authorized testers who act as the adversary. They pursue realistic goals the way a real threat actor would, such as reaching a payment database or reading an executive's mailbox, so the organization can learn whether its people, processes and tools would notice and stop that attacker. The color comes from military exercises, where the red force played the opposing side.
How a red team engagement differs from a penetration test
A standard penetration test tries to find and prove as many weaknesses as possible within a defined scope, usually over one to a few weeks. A red team engagement is driven by objectives instead. It typically lasts longer, values stealth over coverage, and may combine technical, physical and social engineering methods when the rules of engagement allow them. Defenders are often not told it is happening, because the aim is to measure real detection and response. The report follows the path to each objective and marks where defenders did or did not see the activity.
Who sets the rules
Red team work needs the same written authorization as any test, plus extra care because so few people know it is running. A small control group, sometimes called the white team, writes the rules, tracks progress, can halt the exercise if something breaks, and confirms to anyone who asks that the activity is sanctioned. Testers working on site carry a signed authorization letter for the same reason.
Example scenario
A hospital network approves a six-week red team engagement with a single objective: show whether an outsider could reach the patient records database. The team gets there through a chain of small weaknesses. The SOC saw one step, but an analyst closed the alert as a false positive. That missed alert becomes the most useful finding, because it exposes a triage gap rather than a missing tool.
Red team vs. blue team vs. purple team
- Red team: plays the attacker; offensive testing.
- Blue team: the defenders who detect and respond; defensive testing.
- Purple team: red and blue cooperating openly to improve detections; integrated testing.
Frameworks such as MITRE ATT&CK give red teams a shared way to describe the techniques they emulate, which lets the blue team map each step to a detection afterward.
Red team on the CompTIA Security+ exam
SY0-801 objective 5.5 describes these exercises by activity: it lists offensive testing alongside defensive and integrated testing as penetration testing types, and offensive testing is what a red team does, so either name may appear. Scenario clues include a team emulating a specific adversary, chasing a defined objective, or working without the SOC's knowledge to measure detection. Distractors are blue team or defensive testing, which evaluates the defenders; purple team or integrated testing, where both sides cooperate in the open; and a vulnerability scan, which only lists likely weaknesses.