Combine the power of offensive and defensive teams to strengthen your security
A Purple Team exercise brings together the offensive expertise of the Red Team and the defensive capabilities of the Blue Team to identify and remediate security gaps.
By simulating real-world attack scenarios, the Red Team works alongside your Blue Team to define tactics, techniques, and procedures (TTPs) that should be detected and prevented by your existing security controls. Any gaps in control effectiveness are quickly identified, investigated, and addressed through iterative cycles, ensuring continuous improvement.
This collaboration not only strengthens your security defences but also raises awareness and enhances the skills of your defensive teams.
.svg)
Benefits
Significant uplift in the skills and knowledge of the internal security team
Rigorous testing of security controls aligned to common and tailored TTPs
Testing and improvement of playbooks and procedures
Optimisation and rationalisation of security tooling
How it works
01
Planning
As a first step, our Red Team works together with your blue team to design the exercise and define specific scenarios, TTPs and controls for testing.
02
Attack Simulation
Our teams work collaboratively to execute the defined attack scenarios, while monitoring the performance of various prevention and detection controls, including tooling, processes and procedures. Execution will often consist of several iterations, aligned to the different scenarios in scope.
03
Analysis
Our team will review the data collected throughout the exercise, identifying key gaps and opportunities for improvement across people, processes and technologies in use. This will include any feedback and insights from the blue team.
04
Remediation Guidance
Once the exercise is completed, we will present our recommendations on how to close the various gaps identified pragmatically, as part of a program of work.
Best Suited For
Organisations who have an internal security function with an existing detection capability, and who are eager to test and optimise its effectiveness.
Best Suited When
A detection capability has been recently established or undergone a major change.
FAQs
A red team provides higher realism, given that it is conducted covertly, and aims to test the effectiveness of the security stack as a whole against a specific adversary. A purple team on the other hand, is a collaborative exercise, designed to test and uplift mostly the detection capability of an organisation by testing it against a wide range of TTPs.
Purple teams commonly involve key stakeholders from the security team, depending on the organisation’s size and structure. Commonly these include the CISO, the head of the SOC, senior analysts as well as security engineers, depending on the stage of the exercise.
Most purple teams run between four and six weeks, from initial planning to remediation guidance.
A purple team is both well planned and collaborative in nature, minimising the chance of any disruptive activity. We would define together with your team where and how testing is to be conducted, specifically avoiding hyper sensitive areas and higher risk TTPs.
Purple teams require high involvement of the blue team, with an emphasis on senior analysts during the planning and execution phase, with less intensive involvement in the rest of the phases. The high friction is by design, as one of the main goals of the exercise is to uplift the skill level and knowledge of the blue team, which is achieved through their active participation.
We typically encounter issues related to insufficient coverage of data collection agents, inadequate playbooks and procedures, non-optimised tooling and insufficient experience identifying offensive cyber TTPs.
Quick and simple fixes will be applied as part of the execution iterations, and the effectiveness of those fixes will be validated within the defined timeline of the exercise. Larger and more complex remediation items are validated by our team in a separate validation activity.
Ideally, this type of exercise is carried out after a detection capability has been set-up, undergone major changes, or has not been tested in more than 12 months.