Home / Knowledge hub / Purple team
Knowledge hub
Purple team
Attackers and defenders working together so each test improves detection.
What it means
A purple team is an exercise, or sometimes a way of working, in which the people who simulate attacks and the people who defend share what they do in real time. The colours come from red teams, which attack, and blue teams, which defend.
In a classic red team test the attackers work in secret and report at the end. In a purple exercise, the attacker runs a technique, the defender checks whether the alert fired, and they tune the detection together before moving on to the next one.
Why it matters
A test that ends in a report often leaves defenders with a list of what went wrong and no way of knowing whether a change would catch it. Purple work closes that loop, because each technique is run again until the defender can see it.
It uses everyone's time well. Defenders learn how real attacks look in their own logs, attackers learn what is already detected, and the business sees concrete improvement. It suits companies that already have some monitoring and want it to work better, rather than a first-ever test.
How it shows up
Teams often plan around the MITRE ATT&CK framework: pick a technique, run it, check logs and alerts, adjust the rule, and run it again. Output is a list of detections that now work, and gaps that remain. It pairs naturally with breach and attack simulation.
The mistakes repeat. The two sides never actually talk. The exercise tests only what is easy to detect. Or alert rules are changed to pass the test and not to catch real attackers. Agree the techniques beforehand, record every result and schedule a repeat so detections are kept up to date. A real red team test still has its place.
Questions people ask
Purple team, answered
Is a purple team a separate team of people?
Usually not. It is a way of working that brings the red and blue sides together for an exercise. Some companies run it as a regular activity rather than a standing team.
How is it different from a red team engagement?
A red team test is covert and aims to show whether an attack succeeds undetected. A purple exercise is open and aims to improve detection step by step, with both sides in the room.
When is a purple team the right choice?
When you already collect logs and have alerts, and want to know how good they are. If you have no monitoring at all, start by building it, because there is nothing yet to tune.
What do we get at the end?
A list of attacker techniques tested, which ones were detected, which were missed, and the rules or processes improved as a result. You should be able to repeat the tests later.
Does it test web applications?
It can, but it is most often used for network and endpoint detection. Application flaws are usually found through penetration testing and then fed into detection, so defenders learn what those attacks look like.
Sources
Where this comes from
Related
Terms that sit next to this one
Red team
A simulated adversary given a goal and left to reach it however they can.
MITRE ATT&CK
A public catalogue of the tactics and techniques real attackers use.
Breach and attack simulation
Software that repeatedly plays known attacker steps to test your defences.
SIEM
A system that gathers logs from everywhere and raises alerts on suspicious patterns.
Threat hunting
Searching your systems for attackers that alerts have not yet caught.
Would you notice this being tried?
Detection works best when it is tuned on real attack evidence. Our findings come with the exact request and response, which gives your defenders something concrete to watch for. Ask us to run it on one of your applications.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.