Purple Team

What is a Purple Team?

A Purple Team is a way of working in which the Red Team (the attackers) and the Blue Team (the defenders) openly execute, observe and discuss attack techniques together, so that an organisation’s detection and response improve directly and measurably. Where a red team test covertly measures whether the defenders spot an attack on their own, purple teaming is about learning: each technique is executed, the Blue Team watches in the SIEM and EDR, and detection gaps are closed on the spot. Purple is literally the blend of red and blue.

Instead of working separately, both teams share knowledge and insights to learn faster, improve detection rules and raise the overall level of Security.

🧠 What does a Purple Team do?

A Purple Team:

• Acts as a bridge between the Red and Blue Teams - attack knowledge goes straight to the people who maintain detection rules and playbooks
• Replays known attack techniques - based on threat intelligence and the TTPs of adversaries relevant to the sector
• Watches live - while Red runs a technique, Blue checks whether log entries, alerts or blocks appear
• Provides direct feedback on what works and what doesn’t, without waiting for a final report
• Tests, improves and documents the effectiveness of detection and response measures, and retests after each change

In practice, purple teaming is more often a way of working than a permanent department. SCYTHE’s Purple Team Exercise Framework (PTEF) distinguishes three forms: ad hoc purple team exercises, an ongoing virtual team with people from Red, Blue and threat intelligence, and a dedicated team with its own staff.

🔄 How does it differ from a Red Team, Blue Team and pentest?

A red team exercise answers the question “would we see a real attack?“. A purple team exercise answers “which techniques do we miss, and how do we fix that?“. That is why many organisations close a red team test with a purple teaming session.

🔧 How does a purple team exercise work?

1. Choose a threat - use threat intelligence to select a realistic adversary and translate its behaviour into techniques in MITRE ATT&CK or, for industrial environments, MITRE ATT&CK for ICS.
2. Agree the rules of engagement - scope, systems, test window, prohibited actions, an emergency stop and a communication channel between both teams.
3. Red executes a technique - for example Phishing, privilege escalation in Active Directory, lateral movement or abuse of built-in admin tools (Living Off The Land).
4. Blue tries to detect it with tools such as SIEM, EDR, NDR and SOAR.
5. Both teams evaluate together:
   • Was it spotted, and how quickly?
   • How was it handled?
   • Which log sources were useful or missing?
   • What can be improved?
6. Improve and repeat - new detection rules, alerts or playbooks are added, after which Red runs the same technique again to prove the improvement.

For each technique the team records the outcome on a fixed scale. The result is a coverage map that shows where the defence is strong and where it is weak:

🧰 Which tools and techniques does a Purple Team use?

• MITRE ATT&CK - a common language to name techniques and measure coverage; MITRE D3FEND describes the matching defensive measures
• Atomic Red Team - Red Canary’s open-source library of small tests mapped to ATT&CK, under the MIT licence
• MITRE Caldera - an open-source platform for automated adversary emulation; the Caldera for OT plugins speak Modbus, DNP3, BACnet, PROFINET DCP and IEC 61850 MMS, among others
• Commercial Breach and Attack Simulation - platforms such as AttackIQ that replay scenarios in a repeatable, scheduled way
• SIEM, EDR and SOAR for log analysis and automation
• Threat Hunting and alert tuning - hypotheses from the exercise become queries in the logs
• Feedback cycles within the SOC - lessons are captured in incident response playbooks

🏭 How do you apply purple teaming safely in OT?

In OT, availability and safety come first. An unintended command to a PLC can make a machine move or stop a process. Purple teaming suits this well, because everyone knows what is happening and a process engineer can watch directly. Practical rules:

• Risky steps on a test bench - write actions to controllers and protocol attacks belong on a test rig or digital twin, not on the running process.
• Production only passively - in the production environment you mainly test whether a passive OT IDS from, for example, Nozomi, Claroty or Dragos notices an unusual engineering session, a new connection from an engineering workstation or a Modbus write command.
• Never touch the SIS - safety systems stay out of the exercise; attacks such as TRITON show why.
• Scenarios from real OT attacks - techniques from Industroyer or PIPEDREAM are realistic starting points.
• Focus on the IT/OT boundary - test whether the OT SOC sees lateral movement from the office network via the jump server or remote access. That also tests the zoning from IEC 62443.

🔐 Which frameworks and rules mention purple teaming?

The TIBER-EU guidance names several forms. In the testing phase these are catch-and-release, a collaborative proof of concept and a war game. In the closure phase they are a tabletop discussion and re-exploring or further exploring attack paths on live systems. For industrial companies purple teaming is not a legal obligation, but it is a concrete way to show that security monitoring in line with IEC 62443 works in practice.

📈 What does a Purple Team deliver?

Purple teaming also reduces blind spots in infrastructure and monitoring, and produces realistic exercise scenarios for the next threat simulation.

❓ Frequently asked questions

Is a Purple Team a separate team?

A Purple Team is usually not a permanent department but a way of working in which the Red Team and Blue Team collaborate. Larger organisations sometimes set up an ongoing or dedicated purple team. The Purple Team Exercise Framework distinguishes ad hoc exercises, a virtual team and a dedicated team.

How long does a purple team exercise take?

A purple team exercise usually takes a few days per scenario, depending on the number of techniques. Under DORA and TIBER-EU, closure-phase purple teaming must be completed no later than 10 weeks after the active red team phase. Continuous purple teaming repeats techniques periodically.

When should you choose purple teaming over red teaming?

Purple teaming is the better choice when you want to build detection step by step or measure which ATT&CK techniques you can see. Red teaming fits better when monitoring is already mature and you want to test whether a covert attack is noticed. Many organisations combine both.

Is purple teaming mandatory under NIS2?

Purple teaming is not mandatory under NIS2 or the Dutch Cybersecurity Act; the law does require you to assess the effectiveness of your measures. For financial entities that carry out a threat-led penetration test under DORA, purple teaming in the closure phase is a standard part of the test.

Can purple teaming be done safely in an OT environment?

Purple teaming can be done safely in an OT environment if risky techniques run on a test bench or digital twin and the SIS stays out of the exercise. In production you mainly test whether passive OT monitoring sees unusual traffic. A process engineer watches along and can stop the exercise.

Which tools do you need for purple teaming?

For purple teaming you need an emulation tool such as Atomic Red Team or MITRE Caldera, plus your existing SIEM, EDR or OT IDS to measure detection. MITRE ATT&CK serves as the common language. A simple record per technique makes progress visible.

📌 In summary

A Purple Team is above all a cooperative process between attackers (Red) and defenders (Blue) to test, strengthen and rapidly improve Security measures technique by technique.

Where a Red Team measures whether a covert attack is noticed, purple teaming reveals which techniques the defence misses and closes those gaps straight away. MITRE ATT&CK, emulation tools such as Atomic Red Team and Caldera, and frameworks such as TIBER-EU and DORA provide structure. In OT this happens with a test bench, passive monitoring and a process engineer at the table.