Running a proper Purple Team

The talk looks at how to move purple teaming from an idea into a working service. The speaker frames the goal as collaboration between offensive and defensive staff rather than a contest. The benefits covered include closer work between the SOC and attackers, validation of security controls, fresher offensive tradecraft, better detection and response, and a more mature security posture. A coordinator role keeps the cycle of threat intelligence, offensive scenarios, detection work and response moving.

The middle section covers practical trade-offs. Large teams gain throughput, dedicated intelligence staff and tooling, but struggle with prioritisation and slower reporting. Smaller teams are more nimble but run exercises less often. The speaker contrasts simulation, which is automated and suits checking a specific rule or procedure, with emulation, which works toward an objective across a set of techniques. Announced exercises focus on technology and detection, while unannounced ones test people and incident response playbooks. The boundaries between pentesting, red teaming and purple teaming blur in practice.

The closing part covers planning and reporting. Each exercise needs an objective, a stated detection hypothesis, an attack plan, a rules outcome table and an activity log. Useful metrics include rules tested, validated and enhanced, plus time to detect, respond and contain. Endpoints are recommended as the starting point, and a five-level maturity model helps teams plan improvements. The main takeaways are to start small, iterate, and celebrate wins across the organisation.