Purple teaming
Purple teaming is collaborative security testing in which offensive and defensive practitioners share observations to improve how an organization prevents, detects, and responds to selected attacker behaviors.
Work through the behavior together
The offensive side performs an agreed action. The defensive side checks what its tools and analysts saw. They compare those observations, work out why a control behaved as it did, and repeat the relevant step after a change.
Threat intelligence can help choose the behavior. SCYTHE’s Purple Team Exercise Framework brings intelligence, offensive, and defensive practitioners into a shared exercise. MITRE also describes a collaborative purple-teaming approach in its ATT&CK Evaluations.
“Purple” describes how the participants work together. It does not require a third permanent department between the red and blue teams. SCYTHE’s framework covers individual exercises, ongoing collaboration, and dedicated roles.
Separate rehearsal from an unannounced test
A defender who knows which action is coming can help diagnose missing logs or refine an alert quickly. That is useful work. It does not show how the team would respond without that advance knowledge.
Record whether defenders knew the timing and technique, received hints, or changed controls during the exercise. A later test can ask whether the resulting detection works without those aids.
Likewise, an alert appearing on a dashboard is different from an analyst recognizing it and taking the right action. Detection coverage explains that distinction. Keep both teams involved long enough to see where the result breaks down.
Run the Attack Before They Do follows a test across people, procedures, and technical controls, including who needs to act on each finding.