Overview
Many US organizations have bought EDR and a SIEM but have never checked which attacker behaviors those tools catch. A purple team exercise runs agreed techniques one at a time with your analysts watching, so gaps are found and tuned together. Sessions are booked around your team's US time zone, and the output is a list of detections to add, mapped to MITRE ATT&CK.
A purple team exercise is built for improvement rather than surprise. Instead of testing your defenders without their knowledge, our testers and your detection team work in the same room, or the same call, executing attacker techniques openly and watching together whether each one is logged, alerted on or missed. The point is not to win but to measure, and then to fix what the measurement reveals while everyone is still at the table.
We work through a set of techniques drawn from MITRE ATT&CK and chosen to match the threats that matter to you. For each one we run it, check what your tooling captured, and where a detection is missing or weak, your team adjusts the rule or log source on the spot and we run the technique again to confirm it now fires. That immediate loop, execute, observe, tune, re-test, is what makes the exercise so productive compared with a report you action weeks later.
The result is measurable coverage, not just a list of gaps. You finish with a clear picture of which ATT&CK techniques you detect, which you now detect because you tuned them during the exercise, and which need further work, along with the improved rules themselves. It is the fastest way to raise detection maturity and a natural next step after a red team assessment exposes where your visibility falls short.
How US engagements run
- Delivered remotely from India, 9.5 hours ahead of US Eastern in US daylight time and 10.5 hours in winter; calls and testing windows are set around your time zone at scoping
- Fixed-price proposals in US dollars, with scope, dates and the free retest written in before any work begins
- Written authorization signed by someone with authority over every target, because the federal Computer Fraud and Abuse Act and state laws make permission the dividing line
- Reports that name the requirement a test supports, such as PCI DSS 11.4, the FTC Safeguards Rule or SOC 2, without claiming a QSA, ASV or C3PAO role we don't hold
What's included
Our approach
- PlanningWe agree techniques, tooling, participants and success measures with your team.
- ExecutionTesters run each technique openly while defenders watch their tooling.
- MeasurementWe record what was detected, what was missed and why.
- Tuning & re-testDetections are improved on the spot and the technique is re-run to confirm.
- Report & coverageWe deliver before-and-after coverage and the improved detections.
What you receive
- Before-and-after detection coverage by ATT&CK technique
- Improved detection rules created during the exercise
- Record of techniques detected, missed and tuned
- Prioritized list of remaining detection gaps
- Knowledge transfer to your detection team
Standards & frameworks
- MITRE ATT&CK
- PTES
- NIST SP 800-115
- CVSS v4.0
Frequently asked questions
What is the difference from a red team?
A red team is covert and measures whether you detect an unannounced attacker. A purple team is collaborative and open, built to improve detection technique by technique while your defenders watch and tune. One grades you; the other coaches you, and they work well in sequence.
What do our defenders need to bring?
Access to the detection tooling they run day to day, the people who manage it, and permission to change rules during the session. The more your team can adjust log sources and detections live, the more coverage you leave the exercise with.
Do we need a mature SOC first?
Not a mature one, but you do need some detection capability to tune, whether in-house or managed. If you have logging and alerting you want to improve, a purple team pays off quickly; if you have almost no visibility yet, we will suggest building that first.
Is a red team or phishing exercise lawful in the US?
It should only happen with written authorization from the organization that owns the systems. The federal Computer Fraud and Abuse Act and state computer-crime laws treat unauthorized access seriously, so targets, limits, safety contacts and stop conditions are signed before any activity. Ask your counsel about your own position.
How does adversary simulation relate to SEC and NYDFS reporting?
Once an SEC registrant decides an incident is material, it has four business days to file under Form 8-K Item 1.05, and NYDFS Part 500 generally expects cybersecurity events to be reported within 72 hours. A red or purple team exercise shows whether your team would detect and escalate an intrusion fast enough to make those calls.