Purple Team
Combine the power of offensive and defensive teams to strengthen your security
A Purple Team exercise brings together the offensive expertise of the Red Team and the defensive capabilities of the Blue Team to identify and remediate security gaps.
By simulating real-world attack scenarios, the Red Team works alongside your Blue Team to define tactics, techniques, and procedures (TTPs) that should be detected and prevented by your existing security controls. Any gaps in control effectiveness are quickly identified, investigated, and addressed through iterative cycles, ensuring continuous improvement.
This collaboration not only strengthens your security defences but also raises awareness and enhances the skills of your defensive teams.
Benefits
Significant uplift in the skills and knowledge of the internal security team
Rigorous testing of security controls aligned to common and tailored TTPs
Testing and improvement of playbooks and procedures
Optimisation and rationalisation of security tooling
How it works
01
Planning
As a first step, our Red Team works together with your blue team to design the exercise and define specific scenarios, TTPs and controls for testing.
02
Attack Simulation
Our teams work collaboratively to execute the defined attack scenarios, while monitoring the performance of various prevention and detection controls, including tooling, processes and procedures. Execution will often consist of several iterations, aligned to the different scenarios in scope.
03
Analysis
Our team will review the data collected throughout the exercise, identifying key gaps and opportunities for improvement across people, processes and technologies in use. This will include any feedback and insights from the blue team.
04
Remediation Guidance
Once the exercise is completed, we will present our recommendations on how to close the various gaps identified pragmatically, as part of a program of work.
Best Suited For
Organisations who have an internal security function with an existing detection capability, and who are eager to test and optimise its effectiveness.
Best Suited When
A detection capability has been recently established or undergone a major change.
Shahar Zini
Shahar Zini previously served as CTO of an elite cyber technology department in the Israeli government. He had a significant role in leading the development and enhancement of the department's technological capabilities, while mentoring the new generation of cyber security professionals. Shahar won the Israeli Defence Award at the age of 25.
In addition, Shahar served as Chief Architect at XM Cyber, a pioneer in Breach and Attack Simulation technologies, where his work received numerous awards and patents.
Shahar commonly shares his passion about cyber security with his peers through CTF events he builds, and participation in leading conferences, including RSA.
.svg)
Alex Hill
Alex is an offensive security specialist with a wide range of domestic and international experience. He previously led PwC’s Sydney-based cyber security team as a team lead, mentor, and technical cyber specialist. He personally designed and executed hundreds of bespoke offensive technical assessments and cyber uplifts for some of Australia’s biggest brands.
He prides himself on being able to not only break IT systems though – he also does the hands on building and fixing. Alex has been a go-to cyber specialist for Sydney’s fintech/ startup scene as a security architect – building mature, zero-trust corporate and cloud-only product environments.
He has personally operated live incident response teams for public companies performing the hands-on attack investigation, timelining, and remediation. And he filled in as a virtual CISO for one of Australia’s mid-tier banks for a little over a year.
Over the last few years Alex has continued to focus on the offensive red-team space where he excels at getting the most out of exercises by engaging closely with blue teams. As someone with experience breaking, building, and investigating, Alex is the ideal person to provide technical training to upskill defenders and help them get the most out of their tools.
Alex holds a Bachelor of Information Technology (Co-op) from the University of Technology Sydney and a list of cyber-specific testing and architecture certifications.
Chris Archimandritis
With well over a decade of cybersecurity experience, and almost twenty years of experience in different aspects of IT, Chris has led complex security assessments across every industry, spanning three continents. His experience includes both planning and executing sensitive engagements that encompass, among others, critical infrastructure, industrial and residential hardware, core financial and banking systems, purpose-built devices, and cutting-edge smart deployments.
During this time, Chris has also delivered trainings, workshops, and talks for conferences across the world and the APAC region, such as DefCon and AusCERT.
His previous experience as part of academic research groups has provided the tools to tackle any novel problem and assist organisations with cutting edge solutions and platforms.
Having performed engagements on all levels of abstraction, he not only able to both work on the tools as well as analyse and evaluate high level design, but most importantly is able to bridge the gap of management and engineers to provide the best possible strategy to enhance an organisation’s security posture.
His most recent research interests revolve around hardware security, industrial IoT, smart devices and enterprise data platforms.
Chris holds a Bachelor of Computer Science and a master’s degree in Information Systems and has attended several trainings by some of the world's foremost security experts.
.png)
Frikkie Jansen van Rensburg
Frikkie is an offensive security professional with over seven years’ experience specialising in penetration testing and technical leadership. His expertise spans mobile and web application security, hardware security, and complex bespoke engagements in highly regulated sectors such as mobile banking, biometric systems, and medical devices.
Frikkie’s engineering background, with a Bachelor of Computer Engineering from the University of Pretoria, underpins his strong technical foundation. During his studies, he focused on engineering design, software engineering, artificial intelligence, and developed a mobile application utilising optical character recognition and numerical methods.
He is deeply committed to building skills, fostering growth, and supporting mental health awareness within the cybersecurity industry. His experience also includes defining and refining business processes and sales initiatives, ensuring high-quality delivery and client satisfaction.
Frikkie is OSCP certified and continues to expand his technical capabilities through ongoing professional development. He is passionate about knowledge sharing and has delivered tailored security training to clients, helping them understand and mitigate risks in web and mobile environments.
FAQs
A red team provides higher realism, given that it is conducted covertly, and aims to test the effectiveness of the security stack as a whole against a specific adversary. A purple team on the other hand, is a collaborative exercise, designed to test and uplift mostly the detection capability of an organisation by testing it against a wide range of TTPs.
Purple teams commonly involve key stakeholders from the security team, depending on the organisation’s size and structure. Commonly these include the CISO, the head of the SOC, senior analysts as well as security engineers, depending on the stage of the exercise.
Most purple teams run between four and six weeks, from initial planning to remediation guidance.
A purple team is both well planned and collaborative in nature, minimising the chance of any disruptive activity. We would define together with your team where and how testing is to be conducted, specifically avoiding hyper sensitive areas and higher risk TTPs.
Purple teams require high involvement of the blue team, with an emphasis on senior analysts during the planning and execution phase, with less intensive involvement in the rest of the phases. The high friction is by design, as one of the main goals of the exercise is to uplift the skill level and knowledge of the blue team, which is achieved through their active participation.
We typically encounter issues related to insufficient coverage of data collection agents, inadequate playbooks and procedures, non-optimised tooling and insufficient experience identifying offensive cyber TTPs.
Quick and simple fixes will be applied as part of the execution iterations, and the effectiveness of those fixes will be validated within the defined timeline of the exercise. Larger and more complex remediation items are validated by our team in a separate validation activity.
Ideally, this type of exercise is carried out after a detection capability has been set-up, undergone major changes, or has not been tested in more than 12 months.