Purple teaming
White-box. The blue team is in the room.
Purple teaming tests the security stack with the people who run it. The actions are visible. The question is whether detection and decision keep up.
Hands on
Operators and the SOC look at the same activity together. Detections are adjusted while it is still happening.
Assumed breach
The exercise usually starts from a foothold, so the time is spent on what the stack does next. The scope can say otherwise.
Your tools
The work is done in the controls the organisation already owns. To be added: platforms worth naming on this page.
How it runs
01
Planning
Who attends, what is in scope, and what a useful result looks like. To be added: the usual lead time.
02
Simulation
Attacker techniques, executed where the blue team can see them.
03
Collaboration
Sessions with the defenders during the exercise, not a readout weeks later. To be added: typical length.
04
Reporting
What the stack caught, what it missed, and what should change. To be added: the audience for the write-up.