Blue Team

A blue team↗ is the defensive security team responsible for protecting an organization's systems, monitoring for threats, and responding to incidents. Their work includes configuring firewalls, analyzing logs, hunting for signs of compromise, and hardening↗ systems against attack.

Blue teams are often pitted against red teams, offensive specialists hired to simulate real attacks, in exercises designed to test and improve an organization's actual defenses. When both teams collaborate and share findings afterward, the exercise is typically called a purple team engagement.