Purple Teaming In Action: Beyond the Hype

Tuomo Makkonen opens by defining purple teaming as a collaborative approach in which red and blue teams work together rather than against each other. He contrasts it with penetration testing and classic red teaming, which often end in a report with little shared visibility. Purple teaming runs open-book: scope, emulated adversaries and test cases are shared up front, then monthly iterations lead to joint review, mitigation and retesting.

The middle of the talk covers two areas in depth. The first is endpoint detection and response: how EDR agents collect telemetry, why raw alerts need context, and how evasion methods such as vulnerable-driver abuse, telemetry blocking and living-off-the-land techniques probe gaps in coverage. The second is on-premises Active Directory, covering certificate services, SCCM, exposed service-account credentials and attack paths mapped with BloodHound. Throughout, he argues for layered detection that combines brittle indicators with robust behavioural rules.

He closes with a getting-started sequence: set objectives, define scope, assemble stakeholders, use existing tools, secure executive support and iterate. Common pitfalls include chasing framework coverage for its own sake and red teams hiding from blue teams. He ends with predictions about cloud, APIs, supply chains and faster attacks, urging teams to stay grounded and learn from the past.