Purple Teaming: How Red and Blue Teams Work Together

Purple teaming is a collaborative security exercise in which the red team (offensive testers) and the blue team (defenders) work together in the open to test and improve detection. The red team runs a known attack technique, the blue team checks whether it was blocked, logged or alerted on, and both agree a fix before moving to the next one. A purple team is usually a way of working rather than a third standing team.

Where a covert red team exercise asks “would we notice a real attack?”, a purple team exercise asks “for each technique an attacker is likely to use, can we see it, and if not, what do we change?”. The outcome is not a pass or a fail but a set of tuned detections, a record of what was tested and a clear list of remaining blind spots.

What is a purple team in cyber security?

In cyber security, a purple team brings attack and defence into the same room, physically or on a call, so that every attack technique becomes a test of a specific control, log source or alert. The name comes from mixing red and blue. Red, blue and white teams are compared in our guide to what red teaming is.

The two halves can come from different places:

• In-house red and blue teams, in larger organisations that have both.
• External testers with your own security operations team, the most common format.
• External testers with your managed detection or SOC provider, which also shows whether the provider’s service matches what your contract says.

The value comes from the feedback loop. In a covert red team, defenders only find out weeks later which steps they missed. In a purple team, they find out within minutes, while the evidence is fresh and the person who can change the rule is in the room.

How does a purple team exercise work?

A purple team exercise follows a repeating loop: choose a scenario, execute a technique, check detection, tune, and retest. A typical exercise runs like this:

1. Choose the threats. Start from the attackers most relevant to you, such as ransomware groups, business email compromise or a malicious insider, and list the techniques they use. A recent red team report or threat intelligence is a good source.
2. Agree the scenario and ground rules. Decide the environment, test hosts and accounts, safe payloads, who attends (testers, analysts, detection engineers and system owners) and how results are recorded.
3. Execute. The red team runs one technique and tells the blue team exactly when, where and with which account.
4. Detect. The blue team checks whether the activity was prevented, whether it was logged, whether an alert fired, and whether the alert would have been triaged correctly.
5. Tune. Where something was missed, the team enables a log source, writes or adjusts a detection rule, changes an endpoint policy or updates a playbook.
6. Retest. The red team runs the technique again, plus simple variations, to confirm the new detection fires and is not trivially bypassed.
7. Record. Each technique’s result, the change made and any open actions with owners go into a running log that becomes the report.

How is MITRE ATT&CK used in purple teaming?

MITRE ATT&CK, a public knowledge base of real adversary tactics and techniques, gives both teams a shared language. Each test is named by its ATT&CK technique, so results can be tracked over time and compared with the techniques your likely attackers actually use.

Coverage of ATT&CK is not a percentage to chase. A small set of techniques that your real adversaries use, each tested and detected reliably, is worth more than a large matrix of shallow checks.

What is an assumed breach test?

An assumed breach test starts from the premise that an attacker is already inside. The testers are given the access a real attacker might have after a successful phish, typically a standard user account and a corporate laptop, and work from there. It skips reconnaissance and initial access, which saves time and focuses effort on what happens after the first foothold, where most detection opportunities lie.

Assumed breach works in either style: covertly, as part of a red team, or openly, as the starting point for a purple team exercise. Common scenarios include:

An internal penetration test starts from a similar position, a standard user account on the internal network, but its aim is different: to find every path to domain administrator and how to close it, rather than to tune detection. Automated breach and attack simulation (BAS) tools also run assumed breach scenarios, replaying known techniques on a schedule, which makes them a useful way to re-check detections between purple team exercises.

What results should a purple team exercise produce?

A purple team exercise should produce a technique-by-technique record of what your defences did, the changes made during the exercise and a list of open actions. The simplest way to record each technique is one of five outcomes:

Useful measures to track from one exercise to the next are the number of techniques tested in each outcome, new or improved detections, time to detect and respond for each technique, logging gaps closed and actions still open. The NCSC’s 10 Steps to Cyber Security treats logging and monitoring as a core step, and a purple team is one of the most direct ways to show yours works.

Who benefits from purple teaming?

Purple teaming benefits organisations that already collect logs and have someone, in-house or a provider, responding to alerts, and that want to prove and improve what they can detect. It is particularly useful:

• after a red team, to replay the steps that went unnoticed and close each gap
• after deploying or changing endpoint detection, a SIEM or a managed detection provider, to check coverage before relying on it
• before a red team or a regulated threat-led test, to fix detection gaps at a lower cost first
• for a newer security operations team, as hands-on training against realistic techniques
• when you want fixes, not just findings, because detections are written and retested during the exercise rather than months after a report

It is not the right starting point if there is no central logging or nobody watches alerts, because there is nothing for the blue team to tune. Fix those basics first. If the weakness is in decisions and communication rather than tooling, a cyber tabletop exercise tests the people and process side of your response.

How does purple teaming compare with red teaming and penetration testing?

A penetration test finds vulnerabilities, a red team tests covertly whether attacks are noticed, and a purple team openly improves detection.

They work best in sequence rather than as alternatives: penetration testing closes the easy ways in, a purple team makes sure the techniques that remain are seen, and a red team then checks the whole defence under realistic conditions. Our comparison of red teaming vs penetration testing explains when each of the first two fits.

How does Sovereign Secure’s testing support purple team work?

Sovereign Secure runs red team assessments and internal penetration tests, and both produce material your defenders can use in purple team work:

• Red team reports give an attack narrative, a timeline of what your defenders saw and when, and the techniques used, followed by a debrief with your team.
• Internal penetration tests can be run with only a small group informed; we then give you a timeline of our actions so you can check what your monitoring caught.
• An independent tester with approvals you can check. Sovereign Secure is a PCI SSC Qualified Security Assessor (QSA) company and is ISO 27001 certified, and we test web applications, APIs, networks, cloud, mobile, hardware and IoT, wireless, social engineering, source code and AI and LLM applications.

Next step

Tell us what monitoring you have, who responds to alerts and which attacks worry you most. We will recommend a red team assessment or an internal penetration test scoped so the results feed straight into your detection work. Request a quote or call +44 161 523 5276.