Purple teaming
Purple teaming
Test how agreed attacker behaviours appear across your security controls and workflows. Our offensive testers work with your defenders to execute, observe and improve detection and response, then repeat selected actions.
A penetration tester replies within one working hour with the questions that scope the exercise.
Overview
What is purple teaming?
Purple teaming is a collaborative exercise for organisations with a SOC, MDR provider or internal team responsible for monitoring and response. We execute agreed activity, compare it with the telemetry and workflow it produced, improve specific gaps and repeat selected techniques.
This is for you if…
Someone watches your alerts
A SOC, MDR provider or internal security team is responsible for investigating activity in your environment.
Your tools are live but untested
Endpoint protection or a log platform is bought and switched on, and nobody can yet say for certain what it would catch.
Your team wants real practice
Your defenders want to watch the techniques attackers use, run against your own systems, and learn to catch them.
New to the term? What purple teaming means, in our glossary
Why you need it
Why does your organisation need purple teaming?
Detection depends on more than an alert. Relevant telemetry must be generated and collected, a rule or analyst must recognise it, and the resulting case must reach the right response workflow. Purple teaming follows that chain with the defenders responsible for it.
Offensive activity
The agreed behaviour executed against selected endpoints, identities, networks, cloud services or applications.
Telemetry
The endpoint, identity, network and service records produced by that activity and collected by your tools.
Detection and triage
The rule, alert or analyst action that recognises the behaviour and establishes whether it needs investigation.
Response and containment
The escalation, decision and action taken once the activity is understood, including the handover between teams or providers.
Motive
Where can detection and response break down?
Security tools may generate useful evidence without creating an alert, or an alert may be raised without enough context or ownership to produce the intended response. Reviewing configuration alone cannot show how the whole chain behaves when controlled offensive activity takes place.
We select behaviours around your control objectives, attack paths or relevant threat scenarios. Each activity is compared with what was logged, detected, investigated, escalated and contained, so improvements address a specific observed gap.
Telemetry
Whether endpoint, identity, network or service evidence was produced and collected.
Alert
Whether a rule or analyst identified the behaviour with enough context to act.
Triage and escalation
Whether the activity reached the right people and was investigated as intended.
Containment
Whether the agreed response could interrupt the activity and limit its effect.
Reach
What does controlled activity reveal?
We record whether each selected activity generated useful telemetry, raised an alert, reached the expected triage and escalation path, and prompted the intended response. Where timings are meaningful, the exercise can also record how long specific stages took. This creates an evidence-based view of where the defensive chain worked and where it needs attention.
Entry
Initial access
A phishing payload or a stolen password runs on one laptop.
Yields a foothold on one endpoint
Step
Credential access
Passwords and tokens pulled from memory on that machine.
Yields a user's credentials
Step
Lateral movement
Those credentials used on servers the user never normally touches.
Yields a route across the network
Impact
Exfiltration
Data gathered and sent out, the way the scenario's attacker would.
Yields the data the scenario targets
In practice
An exercise can be technique-led, control-led, attack path-led or shaped by a relevant threat scenario. MITRE ATT&CK and threat intelligence can support scenario selection, but the work remains grounded in your environment, tooling and defensive priorities.
Our offensive testers and your defenders work from a shared record of the activity. Gaps may lead to changes in data collection, detection logic, alert context, triage or response playbooks. Selected activity is then repeated where this forms part of the agreed exercise.
Methodology
How Adversify runs a purple team exercise
We select behaviours, run controlled activity, compare the defensive outcome, improve specific gaps and repeat selected actions. We first agree the scope, people, systems and safeguards, so both teams share one clear plan for each stage of the whole exercise.
Consultation and exercise design
We start with your current security posture, your programme and what your team can already do: the tools in place, who watches them and how an alert is handled. From that we design the exercise with you, including its scenarios, its limits and who takes part on each side.
- Security posture
- Exercise design
- Rules of engagement
Select behaviours and controls
We select the techniques, attack path or control objectives to assess. Threat intelligence and MITRE ATT&CK can inform this where useful, but the final activity is chosen around your environment and priorities.
- Behaviours
- Controls
- Scenarios
Execute controlled activity
Our offensive testers run the agreed activity within defined safety boundaries while your defenders observe and investigate. Each action is recorded against the telemetry, alert and workflow it produced.
- Offensive testing
- Defensive observation
- Activity record
Compare and improve
We review what was collected, detected, triaged, escalated and handled. The teams identify the reason for each material gap and agree focused changes to data, rules, alert context or response processes.
- Defensive outcomes
- Focused improvements
- Knowledge transfer
Repeat selected activity
Where included, selected activity is repeated after agreed changes are made. The result is compared with the original observation to show how the telemetry, alert or workflow changed and what still needs work.
- Repeated activity
- Changed controls
- Before and after
Reporting and outcomes
You receive a report of the activity performed, the defensive outcome, the improvements made during the exercise and any residual gaps. It closes with practical recommendations in priority order.
- Engagement report
- Findings
- Recommendations
Coverage
What does a purple team exercise cover?
An exercise can assess selected techniques, a defensive control or part of an attack path. The areas below are examples rather than a fixed sequence. Scoping confirms the activity, systems, participants and safety boundaries, and identifies the defensive questions the exercise must answer for your team or provider.
Initial access
Agreed behaviours representing an initial foothold, where these are safe and relevant to the exercise objective.
Endpoint detection
How your endpoint protection responds to the techniques an attacker runs on a laptop or server.
Identity and privilege
Account takeover and privilege escalation, in Active Directory and in cloud services, and whether unusual sign-ins raise an alert.
Lateral movement
An attacker moving between systems, and whether your network monitoring notices.
Data exfiltration
Controlled activity representing data staging or transfer, using safe test data and boundaries agreed before the exercise.
Logging and alerting
Whether your log platform collects the right logs, raises the right alerts and reaches the right person.
Activity can be mapped to MITRE ATT&CK where this helps selection, communication and reporting.
What you get
What you get from a purple team exercise
You receive a record of each activity, its available telemetry, alerts and defensive workflow. The report captures improvements made during the exercise, the outcome of repeated activity and the residual gaps to prioritise, giving technical teams and decision-makers a shared account.
You receive
The engagement report
A plain account for leadership, and the full timeline for the analysts who defend.
A result for every technique
Each selected activity linked to the telemetry, alert, triage and response it produced.
Detection improvements
The rules, alerts and response steps changed during the exercise, written down.
Time with our testers
Knowledge transfer throughout, so your defenders learn how each attack behaves and where to hunt for it.
What changes
- Each selected behaviour is linked to the telemetry and workflow it produced
- Improvements address an observed gap in technology, process or handover
- Repeated activity records how the defensive outcome changed
Questions
Purple teaming questions
Clients ask how purple teaming differs from red teaming and assumed breach testing, how live operations are protected, whether an MDR provider can take part and how activity is chosen. We agree the participants, objectives and safeguards before work begins.
Not answered here? Ask it on the scoping call
How is purple teaming different from red teaming or assumed breach testing?
Red teaming usually tests broader objectives with limited defender knowledge. Assumed breach testing focuses on what a defined compromise can reach. Purple teaming is collaborative and focuses on how selected activity is logged, detected, investigated and handled.
Will the exercise disrupt our operations?
Scenarios are agreed with you before anything runs, with limits on what may be touched and a named contact on each side. A technique that could affect a live service is discussed with you first, then run in a controlled way or on systems you choose.
Does it work if a managed provider runs our SOC?
Yes. Your provider's analysts take part as the blue team alongside your own staff, and the exercise shows what their service detects in your environment, technique by technique, against the attacks your sector faces.
How are the scenarios and techniques selected?
We start with your control objectives, priority attack paths, tooling and known defensive questions. Threat intelligence and MITRE ATT&CK can help where relevant, but the activity is selected for your environment rather than copied from a generic list.
What is measured and repeated during the exercise?
For each selected activity we record the available telemetry, alert, triage, escalation and response. Timings can be captured where they are meaningful. Where included, selected activity is repeated after focused changes so the defensive outcome can be compared.
What happens next?
Ask us to scope an exercise for your team
Tell us who monitors your environment, which detection and response tools are in place and which attack scenarios concern you. A penetration tester will reply within one working hour to define the participants, techniques, safety boundaries and deliverables before we quote.
- Detection improvements tested with your defenders
- CREST-accredited for penetration testing
- York based, Cyber Essentials
We will discuss your defenders, technology and priority scenarios before anything is quoted.