A red team is a group that plays the role of an adversary to provide security feedback from an antagonist's perspective. Red teams are used in many fields, especially in cybersecurity, airport security, law enforcement, the military and intelligence agencies. Cybersecurity In cybersecurity, a penetration test involves ethical hackers attempting to break into a computer system, with no element of surprise. The blue team (defending team) is aware of the penetration test and is ready to mount a defense. A red team goes a step further, and adds physical penetration, social engineering, and an element of surprise. The blue team is given no advance warning of a red team, and will treat it as a real intrusion. A red-team assessment is similar to a penetration test, but is more targeted. The goal is to test the organization's detection and response capabilities. The red team will try to get in and access sensitive information in any way possible, as quietly as possible. Companies including Microsoft perform regular exercises in which both red and blue teams are used. A purple team is the temporary combination of both teams and can provide rapid information responses during a test. One advantage of purple teaming is that the red team can launch certain attacks repeatedly, and the blue team can use that to set up detection software, calibrate it, and steadily increase detection rate. Purple teams may engage in "threat hunting" sessions, where both the red team and the blue team look for real intruders. Involving other employees in the purple team is also beneficial, for example software engineers who can help with logging and software alerts, and managers who can help identify the most financially damaging scenarios. The initial entry point of a red team or an adversary is called the beachhead. A mature blue team should be adept at finding the beachhead and evicting the attackers. In fact, a role of the red team is to increase the skills of the blue team. When infiltrating, there is a stealthy "surgical" approach that stays under the radar of the blue team and requires a clear objective, and a noisy "carpet bombing" approach that is more like a brute force attack. Carpet bombing is often the more useful approach for red teams, because it can discover unexpected vulnerabilities. During a real intrusion, the red team can be repurposed to work with the blue team to