What is red teaming in cybersecurity? Definition & examples

Red teaming goes beyond a standard penetration test. Where a pentest aims to find as many exploitable weaknesses as possible, a red team picks a concrete objective (for example accessing a sensitive database) and pursues it stealthily, deliberately testing the people, processes, and technology that are supposed to stop an attacker.

How is red teaming different from penetration testing?

• A pentest is breadth-first and noisy, cataloging vulnerabilities in scope.
• A red team is depth-first and stealthy, emulating a specific adversary and avoiding detection.
• Red teams measure the blue team's detection and response, often as a blind exercise.

How does a red team operation work?

Engagements typically chain initial access (often via phishing), establish command-and-control, perform privilege escalation, and then carry out lateral movement across the network toward the objective. Operators emulate known threat actors using the MITRE ATT&CK framework and tools such as Cobalt Strike, Sliver, BloodHound, and Mimikatz.

Red team vs blue team vs purple team

The red team attacks, the blue team defends, and purple teaming makes both sides collaborate to improve detections.

How to practice red teaming hands-on

On Purple Edge the red-team learning hub provides isolated cloud ranges where you can build attack chains, move laterally, and escalate privileges against realistic targets, learning offensive tradecraft safely and legally.