Purple Team: when to combine Red Team and Blue Team
By Kike Gandia · Co-Founder & CEO, OSCP
Purple Team isn't a third team: it's a way of working where the red team (attacker) and the blue team (defender) collaborate in real time, instead of operating covertly and separately as in a classic Red Team. The goal shifts from "measure whether you'd catch us" to "improve your detection together, as fast as possible".
What Purple Teaming actually is
In a Purple Team exercise, the offensive team executes a specific technique — for example, a lateral movement technique via WMI — and, at that same moment, the defensive team checks live whether their SIEM or EDR caught it, which rule fired (or should have fired), and tunes detection right there. It's an iterative attack-observe-tune cycle, with both teams in the same room or call, technique by technique.
Purple Team vs covert Red Team: when to use each
A covert Red Team measures a genuine reaction, with no prior warning — it's the best way to assess the real state of your detection capability today. A Purple Team doesn't measure, it improves: it's collaborative and transparent, ideal when you already know you have detection gaps (from a previous Red Team, a real incident, or a recent infrastructure change) and want to close them efficiently, technique by technique, instead of waiting for the next covert exercise to check whether it worked.
When the collaborative model makes the most sense
Purple Team fits especially well when: you've just deployed a new SIEM/EDR and want to systematically validate its coverage against the MITRE ATT&CK framework; a previous Red Team revealed specific detection gaps you want to close with focus; you have a junior detection team and the goal is practical training as much as technical improvement; or the budget/time doesn't allow a full Red Team but does allow several sessions targeted at the highest-risk techniques for your sector.
Covert Red Team and Purple Team at a glance
Choosing between them is easier when you see them side by side: they answer different questions and produce different deliverables.
| Aspect | Covert Red Team | Purple Team |
|---|---|---|
| Question it answers | Would you catch us? | How do we make you catch us? |
| Does the detection team know? | No, apart from a trusted contact | Yes, they take part live |
| Starting point | An objective to reach | A list of techniques to validate |
| Main output | The report of what went undetected | New or tuned detection rules, proven to fire |
| When it fits | To find out where you genuinely stand | When you already know where the gaps are |
| Friction with operations | Higher: it runs unannounced | Lower: everything is coordinated |
They do not compete: the covert exercise measures and the collaborative one fixes. What makes no sense is paying for a covert exercise when you already know detection has not been built, or running purple against an environment whose real capability nobody has ever measured.
How to prepare a session that is actually worth running
The difference between a useful Purple Team and a nice demo lies almost entirely in the preparation.
Techniques are chosen beforehand, filtering the MITRE ATT&CK matrix down to what genuinely applies to your stack and your sector: walking the whole matrix does not fit in a session and dilutes the result. The detection team needs read access to the SIEM or EDR console during the exercise, because the value comes from looking in the moment, not from reviewing the following week. And you have to agree in advance what "detected" means, because it is not one thing: telemetry being recorded, a rule existing and firing, and the alert reaching somebody who triages it are three different levels.
For every technique executed, note the exact time so it can be found in the logs afterwards. The outcome of each one falls into one of three cases, and each case leads to a different fix: there is no telemetry (a data source or sensor is missing), there is telemetry but no rule (detection engineering is missing), or there is a rule but it did not fire (the rule is badly written or badly tuned). Conflating the three is the usual way to leave a purple exercise feeling improved without having improved.
FAQ
Does Purple Team take as long as a Red Team?
Usually less, and more predictably: being collaborative and focused on specific techniques (rather than a free-roaming objective to discover), a Purple Team session can be scoped to days rather than weeks, covering a specific set of MITRE ATT&CK TTPs.
Can we do a Red Team first and then a Purple Team?
That's the most common and recommended sequence: the Red Team reveals which techniques you failed to detect; the follow-up Purple Team works specifically on those techniques collaboratively until the gap is closed, with immediate validation that the fix works.
What do we need in place before commissioning a Purple Team?
At minimum, a working detection platform (SIEM, EDR or both) with telemetry arriving, somebody able to modify rules during the session, and an environment reasonably close to production. If detection is not deployed yet, a Purple Team turns into a demonstration: it will show that nothing is detected, which you could have known without the exercise.
What is delivered at the end?
The list of techniques executed, mapped to MITRE ATT&CK, with the outcome of each at all three levels (telemetry, rule, alert), the detection rules created or tuned during the session with evidence that they fire, the telemetry gaps identified along with the data source that would close them, and the techniques left pending for the next session.
Can it be done if detection is run by an external SOC?
Yes, and that is often where it adds the most value, because it is the only practical way to check what your provider actually sees and how fast they respond. It requires the SOC to take part in the session with the ability to tune rules, not just to confirm whether an alert reached them. If the contract does not allow that participation, clarify it before planning the exercise.
Does it disrupt operations?
Less than a covert exercise, because everything is coordinated and the defensive team knows what will happen and when. Even so, it runs under written rules of engagement: which techniques are out of scope, which systems are not touched and how the session is stopped if something goes off plan. Techniques carrying an availability risk are swapped for equivalents that generate the same telemetry without the side effect.