31 October 2026 · 10 min read · By Michael van Mameren, Lead Penetration Tester (OSCP)
Purple teaming: what a purple team exercise is, how it runs, and when it beats a red team or a penetration test
A red team tells you whether an attacker can reach the objective. A purple team tells you, technique by technique, whether your SOC would have seen them trying, and fixes the gaps while the attackers are still in the room. This guide explains how a purple team exercise is structured, what it requires, what it produces, and where it sits next to red teaming, penetration testing and the DORA threat-led testing cycle.
What purple teaming is
Purple teaming is a collaborative security exercise in which an offensive team (red) executes specific adversary techniques against an organisation's environment while the defensive team (blue, usually the SOC or an MDR provider) watches in real time to see whether the technique was logged, detected, alerted on and triaged. Where the red team finds a gap, the two teams tune telemetry or detection logic together and the technique is run again until it is caught. The colour is the point: red and blue working in the same room, on the same timeline, against the same list of techniques.
That distinguishes it from a red team engagement, where the offensive team works covertly for weeks against a business objective and the defenders are not told, and from a penetration test, which hunts for vulnerabilities rather than for detection gaps. A purple team exercise is not trying to win. It is trying to measure and improve detection and response coverage against the techniques an adversary relevant to you would actually use, and to leave the SOC with tuned rules and a documented coverage map at the end of the week rather than a report they read a month later.
The common frame of reference is MITRE ATT&CK. Every technique in the exercise is identified by its ATT&CK ID (T1003.001 for LSASS memory credential dumping, T1021.002 for lateral movement over SMB admin shares, T1059.001 for PowerShell execution, T1486 for data encryption for impact), which gives red, blue and management one vocabulary for what was tested, what was detected and what still is not. Our red teaming explainer sets out the covert alternative; this page is about the collaborative one.
How a purple team exercise runs
A typical engagement is one to two weeks of joint sessions, preceded by a week of preparation. The loop below runs for every technique in scope.
1. Define the threat and select techniques
Start from the adversaries that matter to you: the ransomware groups active in your sector, the intrusion sets your threat-intelligence provider flags, or the techniques from a recent incident. Map their behaviour to ATT&CK and select 25 to 60 techniques spanning initial access, execution, persistence, privilege escalation, credential access, lateral movement, collection, exfiltration and impact. Prioritise by likelihood and by what your controls claim to cover.
2. Build the test cases
For each technique the red team prepares one or more concrete procedures: the exact command, tool or payload, the host it will run on, the account it will use, the expected artefacts and the expected detection. Open test libraries such as Atomic Red Team and MITRE CALDERA provide a baseline; the valuable procedures are the ones adapted to your environment and to how the chosen adversary actually operates.
3. Execute, with the blue team watching
The red team runs each procedure and announces it. The blue team checks, in order: did the endpoint or network sensor generate telemetry, did that telemetry reach the SIEM or XDR, did a detection rule fire, did an alert reach an analyst, and would the analyst's playbook have led to the right response. Each stage is recorded as pass or fail with timestamps.
4. Tune and fix
A failure at any stage becomes a joint task on the spot: enable the missing audit policy or Sysmon event, fix the log forwarding, write or adjust the detection rule (often as Sigma, then translated to the SIEM's language), raise the alert's severity, or update the playbook. Detection engineering happens during the exercise, not in a backlog afterwards.
5. Re-run and record
The red team runs the procedure again. If it is now detected end to end, the technique is marked covered with evidence; if not, the loop continues or the gap is logged with an owner and a date. Mean time to detect and mean time to respond are measured for every technique before and after tuning, which gives management a before-and-after figure rather than a list of recommendations.
6. Report the coverage, not just the findings
The deliverable is a detection coverage heatmap over the ATT&CK matrix (typically in ATT&CK Navigator format), the list of rules created or tuned, the telemetry gaps with remediation owners, the before-and-after MTTD and MTTR per technique, and a prioritised plan for the techniques that remain uncovered.
What a purple team exercise needs from you
Purple teaming amplifies a detection capability. It cannot create one from nothing. These are the prerequisites we check in scoping.
- A detection and response function: an internal SOC, an MDR provider or an MSSP with a detection mandate, with analysts available to participate in the sessions
- Endpoint telemetry (EDR or XDR, or at minimum Sysmon and Windows event forwarding) on the hosts in scope, and a SIEM or data platform the blue team can query during the exercise
- Identity and network telemetry: domain controller audit logs, authentication logs from the identity provider, DNS and proxy logs, and firewall or NDR data where lateral movement will be tested
- The ability to change things during the week: audit policies, log forwarding, detection rules and alert routing, with change control that allows it
- A representative environment: production, or a test segment that mirrors production telemetry, with test accounts and hosts the red team may use
- Threat intelligence input, from your provider or ours, to anchor technique selection to the adversaries relevant to your sector
- Legal and operational sign-off, an out-of-bounds list, and an executive sponsor who will act on the coverage gaps the exercise documents
What you get at the end
The outputs are operational, not advisory. Most of them are in production before the exercise ends.
Detection coverage heatmap
An ATT&CK matrix coloured by technique: detected end to end, telemetry present but no detection, no telemetry. The first honest map most organisations have of what their controls actually see.
Tuned and new detection rules
Rules written or adjusted during the exercise, documented with the technique they cover, the test procedure that validates them and the false-positive review performed.
MTTD and MTTR per technique
Mean time to detect and mean time to respond, measured before and after tuning, so improvement is shown in minutes rather than asserted in prose.
Telemetry gap register
Every host, log source or sensor that failed to produce or forward the evidence it should have, with the configuration change required and an owner.
Playbook updates
Analyst runbooks revised where the exercise showed the alert fired but the response would have been wrong, slow or incomplete.
A repeatable test library
The procedures used, packaged so your team or your MDR provider can re-run them after every significant change to the environment or the detection stack.
Purple team versus red team versus penetration test
Three exercises, three questions. Mature programmes run all three on different cycles.
| Aspect | Penetration test | Red team | Purple team |
|---|---|---|---|
| Question answered | Which vulnerabilities exist in this scope and how severe are they | Can a realistic adversary reach a business objective without being stopped | Which adversary techniques does our SOC detect and respond to, and how do we close the gaps |
| Defender awareness | Usually informed | Not informed; covert | Fully involved; collaborative |
| Scope | Defined systems and applications | Objective-based, whole organisation | Defined list of ATT&CK techniques against defined hosts and log sources |
| Duration | Days to a few weeks | Four to twelve weeks including threat intelligence | One to two weeks of joint sessions plus preparation |
| Primary output | Vulnerability findings and remediation | Attack narrative, detection and response assessment | Coverage heatmap, tuned rules, MTTD/MTTR deltas, telemetry gaps |
| Prerequisite maturity | None | A detection capability worth testing covertly | A SOC or MDR with telemetry and the ability to change rules |
| Best used | Annually and after change, for every organisation | Every one to two years once detection exists | After a red team or incident, after SIEM or EDR changes, and before a TLPT |
When to run a purple team exercise
The clearest trigger is a red team report that shows the adversary walked through undetected. A red team proves the gap exists; a purple team closes it, technique by technique, with the people who own the SOC. The second trigger is a change in the detection stack: a new EDR, a SIEM migration, a new MDR provider or a move to a new identity platform all reset detection coverage, and a purple exercise is how you find out what the new stack sees before an attacker does. The third is an incident: replaying the attacker's techniques against the tuned environment is the most direct way to show the board that the same intrusion would now be caught.
Purple teaming is not the first exercise an organisation should buy. If there is no SOC, no MDR and no telemetry, the week will document that fact at length and improve nothing; a penetration test and a managed detection and response service come first. Our comparison of MSSP, MDR and SOC models explains the options for organisations building that capability.
Purple teaming in DORA threat-led penetration testing and TIBER-EU
Purple teaming has moved from good practice to a regulatory expectation for financial entities. The TIBER-EU framework, which the European Central Bank updated in 2025 to align with DORA, structures a threat-led penetration test into a preparation phase, a testing phase (threat intelligence followed by a covert red team) and a closure phase. The closure phase includes a replay of the attack with the blue team and a purple-teaming exercise, in which the red team and the entity's defenders go through the techniques that were used, confirm what was and was not detected, and work through improvements before the final report and remediation plan are agreed with the authority. The DORA regulatory technical standards on TLPT describe the same closure-phase purple teaming for financial entities designated for TLPT under Article 26. In the Netherlands the process runs as TIBER-NL under De Nederlandsche Bank.
For designated entities this means the purple teaming component is planned from the start of the TLPT cycle, with the SOC or MDR provider's participation written into the scope. For financial entities not designated for TLPT, and for organisations in other NIS2 sectors, a standalone purple team exercise delivers the same detection-improvement outcome without the supervisory process around it. Our DORA penetration testing guide explains the Article 24 to 27 obligations in full.
How HackersHub runs purple team exercises
Our purple team engagements are led by the same OSCP- and OSEP-certified operators who run our covert red team engagements, which matters because the procedures have to look like real adversary tradecraft, not a test tool's defaults. We work with your internal SOC or with your MDR or MSSP provider as a full participant: their analysts sit in the sessions, see the techniques as they are executed and own the rule changes. Where you use our managed detection and response service, the purple exercise is how we validate our own coverage of your environment against your threat profile. Technique selection is anchored in threat intelligence for your sector, every procedure is mapped to ATT&CK, and the deliverables are the coverage heatmap, the tuned rules, the telemetry gap register and the before-and-after MTTD and MTTR per technique.
For financial entities we deliver the purple-teaming component of the TIBER-EU closure phase alongside the red team phase, with the same operators, so nothing is lost between the covert test and the collaborative replay. Scope and effort are agreed in writing after a scoping call; we do not publish prices. Michael van Mameren leads the offensive practice and is named on every report.
Frequently asked questions
Find out what your SOC actually sees
A 30-minute scoping call establishes your threat profile, your detection stack and whether your SOC or MDR provider is ready for a purple team exercise. You receive a written scope with named operators and the techniques to be tested. Talk to an expert.