Intel-Driven Adversary Simulation for A Holistic Approach to Cybersecurity

Carlos Gonçalves, the CTI leader at a large Brazilian public bank, explains how his team uses threat intelligence to decide what a purple team should simulate. Intelligence comes from a threat-sharing network of more than 4,000 entities, open feeds, internal incident response work and malware databases, all loaded into an open-source CTI platform. Analysts link reports, indicators and techniques for each threat, then map the techniques to MITRE ATT&CK.

Because no team can simulate every technique, the bank ranks them with MITRE's Top Attack Techniques method, which weighs prevalence, choke points and actionability. The chosen techniques are run through an open-source campaign tool that records red team actions and blue team outcomes such as detected, blocked or only logged. Heat maps show coverage gaps. The first round, about six months and more than 180 tests run as separate red and blue exercises, saw defense success fall because attackers moved faster than defenders could fix gaps. Gains came from better log collection, tuned detection rules, new tools and policy changes.

Moving to a joint purple team model, with everyone on one call and red advancing only once blue had responded, raised defense success rates. The speaker's takeaways: purple teaming gives better results but moves slower, so it should be balanced with traditional penetration tests. Cross-functional teams, including risk, help drive change, and top techniques need constant reassessment as threats shift. Threat actors serve mainly as a narrative guide, and exfiltration was tested as a technique rather than with real data.