Redefining Purple Teaming for Max Impact

Introduction and Evolution of Purple Teaming

Adam Pennington (lead of MITRE ATT&CK at MITRE Corporation), Sydney Marrone (Principal Threat Hunter and Purple Team lead at Splunk), and Lauren Proehl (Global Head of Detection & Response at Marsh McLennan and co-founder of Thor Collective) host a panel on transforming purple teaming from an occasional exercise into a continuous, high-impact operational program. Traditionally, security organizations operated with stark boundaries between offensive red teams and defensive blue teams, resulting in adversarial relationships and siloed findings. The panel explores how contemporary purple teaming unites both disciplines around shared threat intelligence, iterative adversary emulation, and concrete detection engineering.

Core Philosophy: Breaking Down Red and Blue Silos

The panel emphasizes that purple teaming is not merely a scheduled meeting or a one-off assessment, but a collaborative mindset and operational loop. Rather than celebrating red team triumphs or scrutinizing blue team misses, purple teaming creates a safe, blame-free environment where operators execute specific adversary techniques while defenders observe telemetry, alert pipelines, and log collection in real time. This immediate feedback loop allows teams to tune detection rules, address visibility gaps, and validate defensive controls on the spot.

Scoping and Executing Purple Team Exercises

The speakers outline practical methodologies for scoping and running exercises across organizations with varying maturity levels:

Starting in Isolated Environments: When introducing purple teaming to risk-averse organizations, start within dedicated virtual labs or staging environments equipped with production EDR agents and logging pipelines. Demonstrating tangible improvements in a non-disruptive sandbox builds management trust.

Establishing Clear Rules of Engagement: Define explicit guardrails, target systems, and acceptable techniques prior to execution, ensuring management and system owners understand the scope and intent of the assessment.

Iterative Cadence: Rather than conducting single massive annual exercises, conduct focused, frequent exercises targeting specific threat actors, platforms, or attack phases.

Threat-Informed Defense vs. Blue Sky Emulation

A central discussion centers on balancing intelligence-driven adversary emulation against open-ended exploratory testing. While threat intelligence provides rich telemetry for well-documented threat groups (such as APT28 or APT29) in enterprise environments, specialized domains (like operational technology or cloud infrastructure) often have limited public threat data. In mature organizations or specialized sectors, practitioners should pair threat-informed baseline testing with creative, exploratory techniques to uncover unexpected blind spots.

Managing Risk and Organizational Buy-In

Securing executive support requires shifting the narrative from technical exploit metrics to business resilience. By demonstrating measurable gains—such as reduced mean time to detect, verified telemetry pipelines, and closed coverage gaps—purple teams prove their ROI. The panelists advise starting with small, high-confidence wins before seeking approval for more complex scenarios such as live helpdesk social engineering or production infrastructure emulation.

The Role of AI and Future Outlook

The panelists examine how emerging technologies and AI are influencing adversary emulation and threat hunting. While fully autonomous, agentic adversary simulation remains in development, current AI tools significantly lower the barrier to entry by assisting blue teamers with script translation, technique research, and rapid hypothesis generation during hunts.

Key Takeaways and Practical Guidance

Cultivate Collaboration: Purple teaming succeeds when red and blue operators share context openly without ego or fear of failure.

Iterate Incrementally: Build momentum through targeted, repeatable exercises rather than sprawling, infrequent engagements.

Leverage Open Frameworks: Utilize established standards like MITRE ATT&CK and open emulation plans to ground testing in realistic adversary behaviors.