Purple teaming in plain words

In a classic penetration test the testers attack and the defenders may not know. In a purple team exercise both sides work together, openly.

How it runs

1. Choose the techniques that matter to you, such as stealing a password or moving between machines.
2. The attackers run one technique at a time.
3. The defenders look at their tools: was it seen? How fast? Was an alert raised?
4. If not, you fix the rule or process together, and run it again.

What you get

• A clear list of which attack techniques you detect and which you miss.
• Improved detection rules and procedures, tested on the spot.
• A team that has practised responding to realistic activity.

When it helps

When you already collect logs and run monitoring, and you want to know whether they would catch an intruder. If you have not yet had a penetration test, start there. Purple team exercises are being launched as a PurpleTeam service: send us a request.