## Red, Blue, and Purple Teams

The color spectrum of information security.

### Red Team (The Offensive)
*   **Goal**: Simulate a real adversary to test defenses.
*   **Mindset**: "There is always a way in."
*   **Method**: Zero-day exploits, Phishing, Social Engineering, Physical Intrusion.
*   **Outcome**: A report saying "We stole the Domain Admin password in 4 hours."

### Blue Team (The Defensive)
*   **Goal**: Detect and Respond.
*   **Mindset**: "Protect the Crown Jewels."
*   **Method**: SIEM, EDR, Firewalls, Patching, Threat Hunting.
*   **Outcome**: "We blocked the Phishing email. We detected the scanner."

### Purple Team (The Collaborative)
*   **The Problem**: Red Teams and Blue Teams often hate each other.
    *   Red: "Blue team is useless, I pawned them easily."
    *   Blue: "Red team cheated, they used a vulnerability for a system we don't own."
    *   *Result*: No learning happens.
*   **The Solution**: Purple Teaming.
    *   Red Team executes an attack (T1059 PowerShell).
    *   Blue Team watches *in real-time*.
    *   Red: "Did you see that?"
    *   Blue: "No."
    *   Red: "Okay, I will run it again. Tune your SIEM to look for X."
    *   Blue: "Got it! Alert triggered."

### Why Purple is the Future
It moves from "Win/Lose" to "Improvement". The goal isn't to hack the company; the goal is to verify the detection logic.