Two Axes, Often Confused

I'm in a security class this week, and I keep noticing a distinction that seems obvious once you see it and causes a surprising amount of confusion before you do.

There are two separate labeling systems in security, and people mix them up constantly because both use colors.

What you're doing

Red is offense. Acting like an attacker to find out whether defenses hold — and, more usefully, whether anyone notices.

Blue is defense. Logging, configuration baselines, detection, response. Most of it is unglamorous work done long before anything happens.

Purple is the loop between them. Red runs a technique, blue checks whether it showed up in their tooling, and if it didn't, the detection gets built right then and the technique gets re-run. It's a feedback cycle rather than a report that lands six weeks later.

All three are authorized work. The color just names which job you're doing today — and in a small shop, that's often the same person wearing a different hat before and after lunch.

Whether you're allowed to

White hat has permission, a defined scope, and ideally a contract.

Black hat has none of that. Criminal.

Grey hat is somewhere between — unauthorized, but not malicious. Finds a flaw, reports it, had no business looking in the first place.

Same technical skills across all three. What differs is the legal footing.

Why it's worth separating

A red teamer is a white hat doing offense. The labels stack; they don't compete. The failure mode this prevents is saying "we should do a red team exercise" and having someone hear "we're hiring hackers."

The part that's changing

The function axis survives automation fine. Tooling runs red work. Pipelines run blue work. Automated attack simulation can close the purple loop with no human in it.

The authorization axis doesn't survive automation at all. Black, white, and grey assume intent and consent — and a tool has neither. A scanner isn't a grey hat. The person who pointed it at something is.

That's the part I keep turning over. As more execution gets handed to agents, authorization stops being a property of who's acting and becomes a property of the scope someone wrote down beforehand. Which means the written scope isn't paperwork. It's the only thing actually holding the line.

Two questions, not one: what function is this? and who authorized it, in writing?

Drafted with Claude; the framing and the errors are mine.