Traditional red teaming is adversarial by design. The red team operates covertly, the blue team (the organisation’s defenders) tries to detect them, and at the end of the engagement everyone sits down to compare notes. Purple teaming takes a different approach: the red and blue teams work together in real time to systematically improve detection and response.
What purple teaming is
A purple team exercise is a collaborative engagement where offensive testers (red) execute specific attack techniques while defensive analysts (blue) observe, tune, and validate their detection capabilities in real time.
The term “purple” comes from combining red (attack) and blue (defence). But it is not a separate team — it is a way of working. The red team brings the attack capability. The blue team brings knowledge of the defensive tooling and monitoring. Together, they work through a structured set of scenarios to answer a specific question: “Can we detect this, and if not, what do we need to change?”
How a purple team exercise works
A typical purple team engagement follows a structured, iterative process.
1. Define the scope and objectives. The exercise begins with an agreed set of attack techniques to test. These are usually mapped to a framework such as MITRE ATT&CK, which provides a common language for describing adversary behaviour. The selection might be driven by threat intelligence (what techniques are relevant to the organisation’s threat landscape), previous red team findings (what was missed last time), or compliance requirements.
2. Execute a technique. The red team executes a specific technique in a controlled manner. For example, they might run a Kerberoasting attack against Active Directory to extract service account password hashes.
3. Observe and assess. The blue team checks their monitoring tools: did the SIEM generate an alert? Did the EDR flag the activity? Is there a log source that captured the event? The red team provides exact timestamps and details to help the blue team locate the relevant data.
4. Tune and improve. If the technique was not detected, the teams work together to understand why. Is the relevant telemetry being collected? Is there a detection rule that should have fired? Does a new rule need to be written? The blue team makes changes — adding log sources, writing detection rules, adjusting alert thresholds — and the red team re-executes the technique to validate that the new detection works.
5. Document and move on. The result for each technique is recorded: detected or not detected, what changes were made, and what the detection now looks like. The teams then move to the next technique.
This cycle repeats across the full set of agreed techniques. A typical engagement might cover 20 to 50 techniques over several days.
MITRE ATT&CK as a shared framework
MITRE ATT&CK is central to most purple team exercises. It provides a comprehensive, publicly maintained catalogue of adversary tactics and techniques, organised by the phase of an attack (initial access, execution, persistence, privilege escalation, defence evasion, credential access, discovery, lateral movement, collection, exfiltration, command and control, impact).
Using ATT&CK as a shared reference ensures that both teams are speaking the same language and that coverage can be measured objectively. After the exercise, the organisation can produce a heat map showing which techniques are detected, which are partially detected, and which have no coverage — providing a clear picture of defensive gaps.
When to choose purple teaming over a red team
Purple teaming and red teaming serve different purposes. The choice depends on what the organisation needs to learn.
Choose red teaming when:
- You want to test whether your defences hold up against a realistic, covert adversary.
- You want to assess your team’s ability to detect and respond under real-world conditions.
- You need an honest, unbiased assessment of your security posture.
- You have not previously tested your detection capabilities and want to establish a baseline.
Choose purple teaming when:
- You already know you have detection gaps and want to close them efficiently.
- You want to maximise the improvement gained from a single engagement.
- Your blue team has the capacity and willingness to participate actively.
- You want to build your team’s skills by working alongside experienced offensive testers.
- You are mapping your detection coverage to a framework like ATT&CK and want to fill specific gaps.
In practice, many organisations alternate between the two. A red team engagement identifies gaps, and a follow-up purple team exercise systematically closes them.
Measuring success
The value of a purple team exercise is measured by the improvement it delivers, not by whether the red team “won.”
Key metrics include:
Detection coverage before and after. How many of the tested techniques were detected at the start of the exercise versus at the end? A well-run purple team exercise can move an organisation from detecting 30% of tested techniques to 70% or higher in a matter of days.
Mean time to detect (MTTD). For techniques that were detected, how quickly did the alert fire? Purple teaming often reveals that detections exist but are too slow to be useful — an alert that fires 24 hours after the event is not much better than no alert at all.
Mean time to respond (MTTR). Beyond detection, how quickly can the blue team investigate and contain the threat? Purple teaming can include response scenarios to test and improve this metric.
New detection rules created. A tangible output of any purple team exercise is a set of new or improved detection rules, validated against real attack techniques.
Blue team skill development. Less easily measured but equally important. Working alongside a red team gives defensive analysts direct experience of how attacks look from the attacker’s perspective, which materially improves their ability to detect and investigate future incidents.
The collaborative advantage
The fundamental advantage of purple teaming is efficiency. A traditional red team engagement might last weeks, with findings delivered in a report at the end. A purple team exercise delivers findings and fixes in real time. Every hour spent in the exercise directly improves the organisation’s defensive capability.
This makes purple teaming particularly valuable for organisations with constrained budgets or limited engagement windows. Rather than spending the entire budget on a covert assessment and then needing a separate remediation effort, the organisation gets both assessment and improvement in a single engagement.
Purple teaming does not replace the need for independent, adversarial red teaming — an exercise where the blue team knows what is coming is not a realistic test of detection under real-world conditions. But as a mechanism for rapidly and systematically improving detection and response, it is one of the most efficient approaches available.