Not every organization needs a red team, blue team, and purple team on day one. The right time to invest depends on security maturity, threat landscape, and whether your detection capabilities can even support these functions. Paul Dyer, a security professional with over 20 years in IT and eight years focused on security as a SOC analyst, specializes in purple teaming, threat hunting, and application security. In this episode, he breaks down what each team does, when organizations should invest in them, and why certifications alone will never be enough.
You can read the complete transcript of the episode here >
What are red, blue, and purple teams?
The nomenclature comes from military exercises, and the fundamental distinctions carry over to cybersecurity:
- Red Team (Offense): Security professionals who simulate real-world attacks on target systems and networks. They study adversary tactics, think creatively, and exploit weaknesses in infrastructure. Their goal is to find vulnerabilities before actual attackers do.
- Blue Team (Defense): The defenders responsible for tooling, protection, and detection. They defend against threats and attacks, manage security infrastructure, and respond to incidents.
- Purple Team (Collaboration): Either a dedicated team or a subset of red and blue team members who combine both mindsets. They take a holistic view of security posture, using knowledge from offensive and defensive activities to improve overall defenses.
The purple team’s unique value is breaking tunnel vision. Both red and blue teams can become narrowly focused on their specific tools and techniques. Purple teams purposefully think outside the box, providing a comprehensive view that is particularly useful for communicating security posture to the C-suite.
When is the right time to invest in threat hunting and teaming?
Paul is clear: it depends entirely on organizational maturity. Investing in red/blue/purple teams before foundational capabilities are in place wastes resources.
Consider these factors before hiring:
- Security program maturity: If endpoint protection or risk management is not up to par, adding offensive teams does not make sense. Fix the foundation first.
- Threat landscape: An e-commerce company with everything online has different needs than an organization whose primary risks are governance-related. Know your exposure.
- Detection capabilities: Threat hunting requires comprehensive environmental data. If you do not have logs flowing into a SIEM, EDR deployed, and visibility across your infrastructure, hunters cannot hunt effectively.
- Budget and resources: In immature programs, resources are better spent on tooling, incident response, and detection capabilities than on specialized teams.
The principle: do not hire the team before giving them the tools to function. It defeats the purpose and wastes budget that could build the foundation these teams need to be effective.
Are security certifications enough to protect an organization?
Paul has seen organizations with SOC 2, HIPAA, PCI, and ISO certifications still get breached. Certifications provide a snapshot in time, not continuous protection:
- Good foundation: Certifications require processes, documentation, and controls to be in place. This is valuable as a baseline.
- Not sufficient alone: They give you an annual look at your security posture at the time of assessment. Three months later, the landscape has changed.
- Required for business: Some certifications are necessary to win contracts or operate in regulated industries. They serve a business purpose beyond security.
What must accompany certifications:
- Ongoing threat hunting and incident response activities
- Regular policy reviews and updates
- Vendor security assessments
- User training programs
- Continuous risk assessment beyond annual audits
The organizations that get breached despite certifications are those that treat compliance as the finish line rather than the starting point. A rounded security program with continuous validation through red team exercises and purple teaming is what actually reduces risk.
How do red and purple teams help with supply chain security?
With 85-97% of enterprise code using open source and 62% of organizations impacted by supply chain attacks, these teams provide critical guidance:
- Software Bill of Materials (SBOMs): Track all open source components in your codebase. Automated tooling can generate these, helping identify vulnerabilities before attackers find them.
- CI/CD pipeline security checks: Build vulnerability scanning, code analysis, and compliance checks directly into deployment pipelines. This catches issues at development speed rather than waiting for annual assessments.
- Regular security assessments: Go beyond annual penetration testing. Agile development requires continuous security validation.
- Vulnerability awareness: Stay current on which components need updating. Missing a critical patch in a dependency is how supply chain attacks succeed.
- Evaluate alternatives: Sometimes the security risk of an unmaintained open source package justifies the cost of a licensed alternative. For mature organizations, that licensing fee might prevent next year’s breach.
This connects to broader software composition analysis practices and how organizations should think about supply chain security holistically.
How do you start a career in threat hunting and security teaming?
Paul’s advice for aspiring security professionals:
- Build strong fundamentals: Understand how things work from the PC to the network. Operating systems, protocols, and technologies form the foundation everything else builds on.
- Acquire certifications: CEH (Certified Ethical Hacker), OSCP (Offensive Security Certified Professional), and GIAC certifications demonstrate skill to employers.
- Never stop learning: If you want a career where you pass a test and fold your arms, security is not for you. The landscape changes daily.
- Participate in community: Engage with other professionals, share knowledge, and learn from peers in your chosen specialization.
- Develop soft skills: Communication is critical. Being able to explain to a VP why something is insecure, and offering alternatives, makes security a partner rather than a blocker.
- Read broadly: Step outside your lane. A red teamer who understands governance, or a blue teamer who reads about cryptography, avoids the tunnel vision that limits effectiveness.
The soft skills point is particularly important: security professionals who can communicate the “why” behind restrictions find that stakeholders respond with “how should I do this safely?” rather than resistance. This transforms security from a blocker into an enabler, which is the foundation of building effective cybersecurity teams.
