Letthemin: Facilitating High Value Purple Teams Using Assumed Compromise

Introduction to Assumed Compromise Purple Teaming

Sarah Hume, Purple Team Service Lead at Security Risk Advisors (SRA), presents a refined, regimented, and repeatable methodology for conducting purple team assessments using an assumed compromise approach. While the definition of purple teaming varies across the cybersecurity community, Hume articulates how starting from an assumed initial breach enables security programs to maximize testing efficiency, uncover detection blind spots, and foster collaborative improvement between red and blue teams.

Defining the Core Philosophy: Flipping the Burden of Perfection

Traditional defensive posture suffers from the age-old dilemma where defenders must protect every possible asset 24/7, while an attacker only needs to succeed once. Hume advocates "flipping the burden of perfection" through the assumed compromise model. Rather than wasting days of assessment time attempting to penetrate external perimeter controls, organizations provision standard user credentials and endpoint access to the red team. Testing then focuses on traversing the complete attack lifecycle—from persistence and privilege escalation to defense evasion, lateral movement, credential access, and impact. Defenders do not need to prevent every isolated command; they only need to detect and disrupt enough links in the attack chain to break the adversary's progress.

Structuring an Assumed Compromise Engagement

The presentation details key operational assumptions required for a successful exercise:

Assume Controls Will Fail: Recognize that endpoint and network defenses can be bypassed by dedicated adversaries.

Assume Adversaries Will Find a Path: Focus on visibility and response rather than relying on perimeter fortifications.

Assume Another Control Can Be Added: Every test offers an opportunity to craft custom detection rules, hone configurations, or tighten access policies.

Assume Mutual Learning: Red and blue teams participate as equal partners with shared objectives.

Telemetry, Detection, and Prevention Parity

During live exercises, each executed technique is evaluated across three core criteria:

Telemetry Generation: Did the endpoint, network, or cloud sensors record the underlying activity in raw logs?

Alert / Detection Visibility: Did the SIEM, EDR, or SOC consoles trigger an actionable detection alert?

Prevention / Block: Did security controls automatically stop or neutralize the attack technique?

This structured scoring reveals whether a missing detection is due to a logging gap, a parsing error, or an alert threshold issue.

Eliminating Audit-Speak and Fostering True Collaboration

A critical factor in successful purple teaming is interpersonal dynamics and reporting language. Hume advises eliminating traditional audit terminology: avoid words like "failure" or "vulnerability ratings" (critical, high, medium, low), which trigger defensiveness from engineering teams. Instead, frame outcomes as "remediation project priorities" and "engineering tuning opportunities," ensuring all stakeholders remain engaged and motivated.

Tooling, Automation, and Longitudinal Improvement

For exercise execution and automation, Hume highlights the use of Mythic C2 alongside customized Jupyter notebooks to orchestrate multi-stage technique execution and data logging. Automated Breach and Attack Simulation tools and frameworks (like CALDERA) are recommended for continuous regression validation in between comprehensive, human-led purple team assessments.

Key Takeaways and Recommendations

Focus on the Full Killchain: Provision internal access to thoroughly test lateral movement, credential theft, and exfiltration defenses.

Involve Broader Stakeholders: Invite system administrators, engineers, and SOC analysts into the exercise room to observe live attacker techniques.

Drive Incremental Resilience: Measure longitudinal improvement across detection coverage, log quality, and incident response speed over successive engagements.