Team pathways
Nine team views. One mission-readiness model.
Team colours provide intuitive pathways. Underneath, CLIP uses configurable role profiles with formal competencies, permissions, responsibilities, Rules of Engagement and assessment criteria.
CLIP · Role profile model
Illustrative view- 01 · LabelBlue TeamPresentation only
- 02 · Role profilesoc-analyst-l2 · v3.2Versioned and approved
- 03 · CompetenciesTelemetry · Triage · ResponseFramework mapped
- 04 · PermissionsScoped by exercise authorizationNever by colour
- 05 · EvidenceObserved actions and artifactsAssessor adjudicated
Team-colour terminology varies by organization
All pathways
Choose a pathway to explore.
Each pathway defines mission intent, competencies, scenarios, evidence, collaboration and governance.
Red Team
Test assumptions and expose weaknesses through controlled adversary emulation against declared targets.
Reconnaissance · Attack planning · Exploitation
Configurable role profileBlue Team
Protect systems through monitoring, detection, investigation, containment and recovery.
Telemetry · Detection engineering · Triage
Configurable role profilePurple Team
Connect offensive observations to defensive validation, remediation and verified improvement.
Technique mapping · Control validation · Detection tuning
Configurable role profileGreen Team
Provide a progressive entry pathway for foundational knowledge and guided skill development.
Networks · Operating systems · Security basics
Configurable role profileYellow Team
Design, build and verify software using secure-by-design and DevSecOps practices.
Threat modelling · Secure coding · Code review
Configurable role profileOrange Team
Bridge offensive discovery and engineering remediation so weaknesses do not recur.
Exploit analysis · Root cause · Requirements
Configurable role profileWhite Team
Govern scenario execution, Rules of Engagement, injects, safety, scoring and adjudication.
Exercise design · Exercise control · Inject management
Configurable role profileGray Team
Supply a configurable neutral role — observation, support or independent assessment — based on organizational doctrine.
Observation · Range support · Simulation support
Configurable role profileGold Team
Exercise leadership, priorities, crisis governance, risk acceptance and resource allocation.
Situation assessment · Decision-making · Escalation
Configurable role profile
The underlying model
From label to enforceable role profile.
The colour is the entry point. Everything that governs access, responsibility and assessment lives in the versioned role profile beneath it.
- 01LabelRed, Blue, Purple and so on — presentation only.
- 02Role profileVersioned, approved, organization-specific.
- 03CompetencyTasks, knowledge, skills and proficiency.
- 04PermissionsScoped by exercise authorization, never by colour.
- 05EvidenceObserved actions supporting a readiness claim.
In sequence: A team label maps to a versioned role profile, which defines competencies, which determine permissions within an exercise authorization context, which in turn shape the evidence a learner produces.
Collaboration
How the teams work as one system.
A mission sits at the centre. These are the relationships that carry work between roles.
- Red → Bluethrough Purple validationEmulated techniques become validated detections and closed gaps.
- Yellow → Red/Bluethrough Orange remediationEngineering changes are verified against adversary behaviour.
- Whitegoverns exercise executionScope, Rules of Engagement, injects, safety and adjudication.
- Goldgoverns strategic decisionsPriorities, escalation, resources and risk acceptance.
- Graysupports and observesNeutral support, evidence review or independent assessment.
- Greenfeeds every pathwayProgressive readiness into each specialised role.
Scenario example
Nine roles, one exercise.
A single scenario exercises the whole system rather than one role in isolation.
- 01Red, Blue and Purple execute the technical exercise and validate detections.
- 02White controls execution, releases injects and adjudicates outcomes.
- 03Gold makes time-bounded decisions with incomplete information.
- 04Yellow and Orange take findings into remediation and secure redesign.
- 05Green participates at a supervised level and progresses.
- 06Gray supports the range or independently reviews the evidence.
Your definitions
Configure your own taxonomy.
There is no universal international definition for every team colour. Each installation approves its own semantics — especially for Green, Yellow, Orange, Gray and Gold.
CLIP stores each definition as a versioned role profile, so a change is auditable and prior exercise evidence remains valid against the version it was assessed under.
Map your roles to CLIP.
We start from your approved role definitions and competency framework, not from a fixed taxonomy.