Red Team & Adversary Emulation
Goal-based, stealthy campaigns that emulate a real threat actor end to end, measuring whether your people, processes, and tooling detect and stop an intrusion, not just whether one is possible.
Service 10
Purple team exercises
A red team report tells you what you missed, weeks after the fact. A purple team exercise closes the gap in the room: we run a technique, your defenders check what they saw, and together we fix the blind spot before moving on to the next one.
Overview
The problem we are solving
Purple teaming is the fastest way to turn offensive testing into better detection. Instead of a covert engagement followed by a report, we work openly with your security operations team, executing attack techniques one at a time and checking your telemetry, alerts, and response after each one.
Techniques are chosen from MITRE ATT&CK based on the threats most relevant to you, often the behaviors of ransomware operators and the threat groups active in your industry. When something is missed, we look at why together: missing telemetry, a detection rule that does not fire, or an alert that fires but goes nowhere. Then we rerun the technique until the gap is closed.
Exercises work well on their own, as a follow-up to an assumed breach or red team engagement, or as a recurring program that tests new detections as your environment changes.
Coverage
What an exercise covers
Scope is agreed up front; these are the areas an engagement typically covers.
- Threat-informed test plan
- A set of ATT&CK techniques selected for the threats you are most likely to face, agreed with your team before the exercise.
- Telemetry coverage
- Whether each technique produces the logs and events your tooling needs to see it, across endpoint, identity, network, and cloud sources.
- Detection engineering
- Building and tuning detection rules in your SIEM or EDR during the session, then rerunning the technique to confirm they fire.
- Alert triage & response
- Whether alerts reach the right people, are understood, and lead to the right response actions within an acceptable time.
- Knowledge transfer
- Your analysts see exactly how each technique works from the attacker's side, which makes them better at recognizing it in real incidents.
Methodology
How the engagement runs
-
01
Planning
Agree objectives, participants, tooling in scope, and the techniques to test, based on your threat profile and any previous testing results.
-
02
Baseline
Review current detection coverage and logging sources so the exercise focuses on likely gaps rather than known coverage.
-
03
Execute & observe
Run each technique in a controlled way while your team checks telemetry and alerts, recording what was logged, detected, and acted on.
-
04
Tune & retest
Close gaps in the session where possible by adding logging or adjusting detections, then rerun the technique to confirm the fix works.
-
05
Reporting
A coverage matrix showing each technique's status before and after the exercise, with outstanding gaps and recommended next steps.
Deliverables
What you receive
- MITRE ATT&CK coverage matrix showing detection status before and after
- Detections built or tuned during the exercise, documented for your team
- Outstanding gaps with prioritized recommendations
- Commands and procedures for each technique so your team can rerun tests on its own
- Debrief with security operations and leadership
Aligned to
- MITRE ATT&CK
- MITRE D3FEND
- Threat actor TTPs from public threat intelligence reporting
Questions
Frequently asked
How is this different from a red team engagement?
A red team engagement is covert and measures how your defenses perform unaided. A purple team exercise is open and collaborative, built to improve detection on the spot. Many clients run a red team or assumed breach engagement first, then a purple team exercise to close what it found.
Who from our side needs to be involved?
Ideally the people who own your detection and response tooling: SOC analysts, detection engineers, or your MSSP contact. If an MSSP runs your monitoring, they can usually join remotely.
Is it safe to run attack techniques in production?
Yes, when done carefully. Techniques are executed in a controlled way on agreed systems, and anything with a risk of disruption is discussed beforehand or run in a test environment.
Can this be a recurring program?
Yes. Many teams run exercises quarterly to test new detections, cover new techniques, and confirm coverage after tooling or environment changes.
Related
Often scoped together
Assumed Breach Assessment
Testing that starts from the inside: a compromised user or workstation, and the question of how far an attacker can get from there before anyone notices.
Get started
Ready to scope purple team?
Scoping conversations are free and usually take twenty minutes. You will speak directly with the consultant who would do the work.
Request an assessment
or reach out directly, (608) 520-0719 sales@infocus-security.com