Why I love Purple Teams, even though they don't exist

Anthony Switzer opens by asking whether purple teaming is an actual team at all. He notes that the term is loosely defined in the industry and that almost no one in the room identifies as working on one. He traces his own path through certifications and penetration testing, arguing that security work should help businesses prevent and fix problems, not only break things.

The middle of the talk looks at why red and blue teams often compete rather than cooperate. Switzer describes the common siloed organization, where technical staff rarely communicate across groups, and contrasts it with a matrix structure that uses a cross-functional project to connect them. He suggests that blue defenders should build enough offensive knowledge to understand attacker motives and likely next steps. He frames purple teaming as largely a communication and education problem, and argues that many organizations may not need a new team at all.

He closes by encouraging attendees to look outside security for solutions other industries have already used, to learn business language, and to consider moving from technical roles toward the business side. In the question period, he suggested that blue teamers can gain red-team knowledge through training rather than through a separate purple team.