In AI security testing, what are red team and blue team roles?

• A. Blue team audits financial compliance.
• B. Red team simulates attacks to identify weaknesses.
• C. Red team simulates attacks to identify weaknesses; blue team defends and mitigates those weaknesses.
• D. Blue team defends and mitigates weaknesses.

Answer: (C)

Red team and blue team roles embody attacker emulation and defense. The best answer states that the red team simulates attacks to identify weaknesses, while the blue team defends and mitigates those weaknesses. In practice, red team activities model real-world adversaries, probing systems and AI components for vulnerabilities—such as adversarial inputs, data poisoning attempts, prompt injections, or model evasion techniques. The blue team then detects, analyzes, and responds to these attempts, patches weaknesses, strengthens controls, and improves monitoring and incident response. This creates a continuous feedback loop: the red team reveals gaps, the blue team closes them, and the organization enhances its security posture.

The other statements misfit because one emphasizes only defense (without the offensive testing to reveal weaknesses), while another centers on compliance auditing, which isn’t the focus of AI security testing.