Currently I am potentially facing impostor syndrome in regards to the role and skillset of blue team members (defence) and red team members (attack).

I personally specialise in defence capabilities, such as secure system design, secure programming, secure website architecture, etc.

For example, I have a thorough understanding of how to design a website that is resistant to cross-site scripting, using techniques such as Content-Security-Policy, sandboxing, etc.

However, I have limited experience with actually performing cross-site scripting attacks. I am aware of, but not familiar with the various techniques, WAF bypasses, etc, and I would definitely find it challenging to construct an advanced XSS attack right this second without some prior research.

It seems within the security community that red team members (pen testers, etc) have all the knowledge of the defence people, and they have 'ranked-up' and proven themselves to be good enough for attacking.

My question is whether there really is a distinct difference between blue and red teamers in regards to skillset and experience, or are all red teamers just defence people who have got through initiation and are now doing the trendy hacking stuff?

  • Where are you finding these people who actually know how to build an attack and aren't just "professional burp suite operators"? Share some resumes? :) :)
    – Affe
    Jan 18, 2019 at 23:12

2 Answers 2


The idea that redteamers or pentesters are 'skilled up' from blueteamers is a misconception, plain and simple.

In the same way that you can defend against XSS without necessarily knowing how to construct a complex XSS attack (which encompasses more than just the XSS code itself, i.e. the payload), you don't need to know how to write code to prevent XSS before you can construct one.

There are a TON of people who work as redteamers or pentesters without ever having worked in a SOC, or on a blueteam, or certainly done any professional software dev (and thus, no secure coding experience).

Don't let anyone tell you otherwise.

Now, whether blueteamers and readteamers should know how to do both jobs is an entirely separate debate.

  • 3
    Without opening said debate, I second this opinion. It’s really hard to find pen testers who can actually help developers understand how to fix the vulnerabilities they find. And these days pen testers who just run OWASP ZAP and nmap and throw the results in a spreadsheet with no context are very common. Those types of reports just don’t help blue team members. So don’t get down on yourself for not being able to construct an attack. It’s more important for blue team to learn how to identify potentially vulnerable code and how to fix it.
    – nbering
    Jan 19, 2019 at 4:36

I have met various people who have worked both red and blue at some point, and they will pick one or the other for various reasons. Some enjoy the thrill and satisfaction of solving the puzzle and breaking in, while others may find it more enjoyable to be the one who gets to build an elaborate fortress and outsmart the attacker. Ideally, the skill set would be completely overlapping since an attacker would need to stay up to date with what defenders are doing and vice versa. The more you know about the opposite role, the better you can do your job. That said, the jobs are often conducted at a different pace and in a different fashion, from which further preference may be derived.

Red teaming seems like a "hot" job since the tools are flashy and the work can be exciting, but there's nothing that necessarily requires more experience than that of a blue teamer. Sometimes a different mindset is required for each though, and the attacker's seems harder to come by IMO.

However, there are various types of jobs within each field that require different levels of technical knowledge and experience. Some in penetration testing jobs will dig through source code and write their own tools, while others are just running vulnerability scanners and Metasploit without truly understanding (these tools have a place, but they are not everything). Some defenders are simply installing all-in-one enterprise solutions and checking the box on compliance, while others understand their networks in depth and are using automation, performing tests, and have found a way to make the most of monitoring and alerting.

TL;DR; both jobs can be equally technical and require a unique skill set, but it depends on the individual to make the most of each position.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .