Purple Team Assessment
A purple team assessment runs threat emulation with your defenders in the room rather than against them. We execute documented adversary techniques one at a time while your detection and response team watches their own tooling, so each gap is found, understood, and closed inside the session rather than written up for later.
Adversary Simulation & Emulation — practice area
What the engagement covers
Collaborative exercises run alongside your detection and response team.
Technique selection
The techniques executed are drawn from documented adversary behaviour relevant to your sector and environment, and agreed with you before the session rather than taken from a generic list.
Telemetry validation
For each technique, whether the underlying event was logged at all, whether it reached your detection platform, and whether it arrived with the fields needed to write a rule against it.
Detection validation
Whether an existing rule fired, whether it fired with enough context to triage, and how often it would fire on normal activity.
Detection engineering
Where a gap is found, a rule is drafted and tested against the technique during the session, so coverage is demonstrated rather than recommended.
Response playbooks
The steps your team takes once an alert fires, exercised against live activity and refined where the session shows them to be slow, ambiguous, or incomplete.
How we do it
Scope is agreed in advance and documented in a statement of work before any work begins.
01
Preparation
We agree the techniques in scope, the systems they will run against, and the detection platform in use, and confirm your team has the access needed to work alongside us.
02
Execution in sessions
Techniques run one at a time with both teams present. We state what we are about to do, execute it, and your team reports what their tooling showed, which isolates every gap to a single cause.
03
Coverage record and handover
Every technique, its telemetry and detection outcome, and any rule written during the session are recorded, leaving a documented coverage baseline to build on.
What you receive
Written so findings can be assigned directly to the teams that will act on them.
Coverage matrix
Each technique executed with its telemetry, detection, and response outcome, giving a baseline of what your current stack sees.
Detection content
The rules drafted and tested during the sessions, in the format your detection platform uses, ready to promote into production.
Gap and tuning register
Techniques that remain uncovered, what each would require in logging or tooling, and the tuning changes identified for rules that fired too broadly.
Also in Adversary Simulation & Emulation
Objective-based red and purple team exercises against live defences.
Red Team Assessment
Objective-based simulation testing detection and response across systems, processes, and personnel.
Frequently asked questions
- How does a purple team assessment differ from a red team assessment?
- A red team assessment is adversarial and measures what your defences detect without warning. A purple team assessment is collaborative: both teams work together, techniques are executed openly one at a time, and gaps are closed during the session. A red team tells you how you perform under a real intrusion; a purple team builds the coverage that performance depends on.
- Do we need a SIEM or EDR already in place?
- You need a detection platform your team can query during the session, because the exercise validates what that platform sees. The specific tooling does not matter, and part of the value is establishing what your current stack captures before any further investment in it.
- Is a purple team assessment disruptive?
- Techniques are executed in agreed sessions against agreed systems, with your team present throughout and aware of every action before it runs. Scope and stop conditions are documented beforehand, and because the work is collaborative any activity can be halted immediately.
Scoping this engagement
Send us the systems in scope and the outcome you need. We will respond with a proposed scope, timeline, and commercial terms.
Request a proposal