- Home
- Offensive Security & Hunting
- Purple teaming
Prove your SOC detects,
one technique at a time.
We execute known adversary techniques in the open while your analysts watch their own tooling. Every gap is found, fixed and re-tested before the session ends.
A working session, not a surprise attack.
A red team report arrives weeks after the operation. Purple teaming turns that around. Our operators sit with your SOC analysts and detection engineers, run a technique, and everyone looks at the same screen: did the SIEM alert, did the EDR see it, did the analyst triage it correctly?
Where the answer is no, we work out why on the spot: missing telemetry, an absent rule, a misconfigured log source or a triage gap. Your team builds or tunes the detection, we run the technique again, and we move on only when it fires. Every technique is mapped to MITRE ATT&CK, so you end with a before-and-after picture of coverage.
- A baseline ATT&CK coverage map before the exercise
- Technique-level scoring: detected, partial or missed, with the root cause
- New and tuned detections, built and validated during the session
- An updated coverage map showing what you can now detect
- A prioritized backlog for the detections still to build
Plan, run, fix, re-run.
Plan together
We pick priority techniques from the groups most relevant to your sector and map your current coverage against them.
Run in the open
Each technique is executed with full transparency while your team watches SIEM, EDR and network telemetry in real time.
Fix on the spot
Where a technique is missed, we find the root cause and your engineers write or tune the detection with us.
Re-test and record
We re-run the technique until it is reliably detected, then record the result in the coverage map.
Coverage that keeps pace.
Purple teaming works best on a cadence. Each cycle builds on the last.
- Monthly or quarterly exercises with cumulative ATT&CK tracking
- New techniques introduced as threat intelligence changes
- Regression testing so earlier detections keep working
- Hands-on exposure that builds analyst skill with each cycle
- Coverage trends leadership can follow over time
Who it is for
Organizations with a SOC, an MDR provider or a detection engineering team who want proof that it detects, and a faster way to close the gaps than waiting for a report.
- Red team, the unannounced version of the same question
- Blue team, detection engineering between exercises
- Threat hunting, our library of hunt queries for your team
- MDR, detections run by us, around the clock
What buyers ask.
This sounds like a test our team could fail.
It is explicitly not pass/fail. Your team is in the room, sees every technique as it runs, and leaves knowing what to tune. A missed technique is the point of the exercise, not a mark against anyone.
How is this different from a red team?
A red team is unannounced and measures whether your defenders notice. Purple teaming is open and collaborative, built to fix detection gaps as fast as possible. Many clients run a red team, then purple team the gaps it found.
Our detections are run by an MDR provider. Can we still do this?
Yes, and it is a good way to see what your provider actually catches. We can include them in the session so fixes are made where the detections live.
Do we need ATT&CK expertise in-house?
No. We bring the technique catalogue and the mapping. Your team brings knowledge of your tools and environment, which is what the session needs.
Stop guessing what your SOC can see.
Put an engineer on a call to plan a purple team exercise around your environment. No charge, no commitment.