A red team attacks your company the way a real hacker would. A blue team defends it. A purple team puts both in the same room, so every attack becomes a lesson, and every lesson becomes a fix. For most SMBs, the purple team delivers the most value, not the red team. Here is why, and how to choose.
Three teams in one sentence each
| Team | What it does | The question it answers |
|---|---|---|
| Red team | Acts as a real attacker, with a specific goal and without warning your defenders. | Can we be compromised? |
| Blue team | Defends: watches alerts, detects and responds. | Would we see it coming? |
| Purple team | Attackers and defenders work together, one attack at a time. | Both at once, and how to improve right away. |
NIST, the US reference body for cybersecurity, defines a red team as a group authorized to emulate an adversary’s attack capabilities, and a blue team as the group responsible for defending information systems. NIST has no official definition of a purple team; the European Central Bank describes it as a collaborative activity between the two teams.
A red team is not a penetration test
The two are often confused, even within the industry. The difference is simple:
- A penetration test looks for as many weaknesses as possible within a defined scope: your servers, your network, your Microsoft 365. Your team usually knows it is happening.
- A red team pursues a goal, such as “reach the payroll data”, by any realistic path, while staying quiet. Your defenders are not told.
The European Central Bank’s TIBER-EU framework says it plainly: a penetration test does not assess the full scenario of a targeted attack against an entire organization. A red team does. To decide between a penetration test and an audit, see our guide Penetration test or security audit.
The real problem: most attacks go unnoticed
Having antivirus and a firewall does not tell you whether anyone would see an intruder. The 2026 numbers are blunt:
- 14 days. That is the median time an attacker spends inside a network before being discovered, according to Mandiant’s M-Trends 2026 report (Google).
- One time in three, the organization learns about the attack from outside (34%). In 14% of cases, the attacker tells them, often with a ransom demand.
- 124 days to detect, 57 to contain. That is the Canadian average in IBM’s 2026 Cost of a Data Breach report, which puts the average cost of a breach in Canada at $7.11 million. That average comes mostly from large organizations, but the delays speak to everyone.
- 31% of intrusions start by exploiting a vulnerability, and ransomware shows up in 48% of breaches, according to Verizon’s 2026 DBIR, which notes that small organizations are disproportionately hit.
A red team measures whether you see the attacker. A purple team teaches you to see them.
Scenario: what a red team finds in one week
A composite scenario, based on situations that are common in SMBs. The company, names and details are invented.
A 45-employee services firm in Laval. Antivirus on every computer, a recent firewall, nightly backups. Management feels well protected. The goal given to the red team: reach the payroll folder.
- Day 1. In a list of passwords leaked from an unrelated website, the team finds the password of a former employee. His Microsoft 365 account was never disabled.
- Day 2. The account has no multi-factor authentication. The team signs in. No alert.
- Day 3. In his files, an Excel sheet named “passwords” sent by a former technician years ago. It contains the administrator access to the file server.
- Day 4. The payroll folder is open. The antivirus saw nothing: no malware was used, only real passwords.
- Day 5. Debrief. The owner sees the full path, from a forgotten account to payroll, on a single page.
What stands out is not the technique: it is that none of the four steps set off an alert. A purple team exercise replays that same path, step by step, until each one is detected.
Purple team: where the “wow” happens
In a classic test, you get a report weeks later. In a purple team exercise, you watch attack and defence respond to each other live. Here is what a typical day looks like (an illustrative example, not a real engagement):
| What the attacker tries | Seen by the defence? | What gets fixed on the spot |
|---|---|---|
| A phishing email steals an employee’s Microsoft 365 session | No: no alert | Turn on unusual sign-in alerts and conditional access |
| A rule forwards the owner’s email to an outside address | No | Block automatic external forwarding and alert on new rules |
| The same password is tried on the file server | Yes, but the alert lands in a mailbox nobody reads | Route the alert to the right place, with a named owner |
| All three attacks are replayed at the end of the day | Yes, all three | A written action plan for the rest |
That is the “wow”: by the end of the day, the same attacks that slipped through in the morning set off alerts. You do not leave with a list of problems, but with defences that have been tested.
It is also the approach the SANS Institute recommends: go purple before red. Once you know how to test, measure and improve, you can move on to stealthy red team exercises.
Why most companies don’t do it
- They think antivirus is enough. Nobody checks whether alerts are seen, or by whom.
- They confuse it with an audit or a scan. An audit checks on paper; a scan lists weaknesses. Neither simulates an attacker.
- A red team is expensive and built for mature organizations. In Canada, OSFI frames red team exercises for systemically important banks and insurers. For an SMB without monitoring in place, a red team mostly confirms that nobody sees anything.
- Fear of breaking something. A well-run exercise agrees in advance on what is allowed, when, and how to stop.
- Few providers can do both sides. In our experience, many IT firms only defend, and many testing firms only attack. A purple team needs both.
Which one fits your situation
| Your situation | What we recommend | Price |
|---|---|---|
| You have never tested anything | Automated scan, then a penetration test | $500 to $1,500, then from $4,000 |
| You have monitoring (advanced antivirus, alerts) but don’t know if it works | A purple team exercise | Quote based on scope |
| Your weaknesses are fixed and a team watches your alerts | A red team exercise | From $12,000 |
| You must prove due diligence (insurer, client, privacy law) | Penetration test with report, then purple team | From $4,000 |
Price depends on scope: number of IP addresses or sites, internal or external, duration and retest. Details in our guide How much does a penetration test cost.
Why UpSystems does it
- An in-house team that works both sides. The same specialists who manage and monitor SMB networks every day run the attacks. We know how an attacker thinks, and what your tools can actually see.
- No anonymous subcontractor. The team is based in the Montréal area and works across Québec and Ontario, remotely or on site.
- Posted prices. Scan $500 to $1,500, penetration test from $4,000, red team from $12,000. Purple team is quoted based on scope.
- An in-person debrief. We walk you through each attack in plain language and build the action plan with you. You are never left alone with a PDF.
Want to know whether your team would spot an attack? Book a 30-minute call or see our penetration testing page.
Frequently asked questions
What is the difference between a red team and a blue team?
The red team attacks, like a real hacker, to see whether it can reach a goal. The blue team defends: it monitors, detects and responds.
Does an SMB need a red team?
Rarely as a first step. Without monitoring in place, a red team mostly confirms that nobody sees anything. A penetration test, then a purple team, gives more value for the same budget.
Does a purple team disrupt operations?
Not when it is well run. We agree in advance on the systems in scope, the hours, and how to stop any test at any time.
How much does a red team cost?
At UpSystems, from $12,000, depending on scope and duration. Purple team is quoted based on scope.
Sources: NIST CSRC glossary; European Central Bank, TIBER-EU framework (2025) and Purple Teaming Best Practices (2022); Mandiant M-Trends 2026; IBM Cost of a Data Breach 2026 (Canada); Verizon DBIR 2026; SANS Institute; OSFI.