Blue team
The defenders: the people responsible for detecting, investigating, and responding to attacks.
The blue team builds and runs the detection and response capability, tunes the tooling, and handles incidents. In most businesses this function is outsourced rather than staffed internally.
Their measure of success is how quickly they notice and contain, which is why exercises that test detection are more useful to them than a list of unpatched software.
Where this comes up
Blue team sits inside our penetration testing work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.
Related terms
Red team An adversarial exercise testing whether your detection and response can catch a determined attacker pursuing a specific objective. Purple team A collaborative exercise where attackers and defenders work together, testing detection technique by technique. Security operations centre The team and tooling responsible for monitoring, investigating, and responding to security events. Incident response The structured process of detecting, containing, eradicating, and recovering from a security incident.