Definition
A purple team brings the red team (attackers) and blue team (defenders) together in open, collaborative exercises, so attack techniques are tested, detection gaps are found and defences are improved straight away.
What a purple team is
A purple team is the combination of a red team (the attackers) and a blue team (the defenders) working together, openly, to improve an organisation's security. The red side runs real attack techniques; the blue side watches in real time, checks whether they were detected, and fixes what was missed before moving on.
The name comes from mixing red and blue. In many organisations, purple teaming is not a separate team at all but a way of working: a series of joint exercises where attackers and defenders share what they see as it happens.
Why purple teaming exists
In a classic red team exercise, the attackers work in secret and the blue team learns what happened only in the final report, often weeks later. That is useful for testing real detection and response, but slow for improving it:
- Lessons arrive late: by the time the report lands, logs may be gone and context forgotten
- Little detail on detection: the report shows what the red team did, not why each step was or was not detected
- Adversarial dynamic: red "wins" by staying hidden, which does not always help blue get better
Purple teaming closes that gap. Each technique is run, checked and improved in the same session, so detection gets better immediately.
How a purple team exercise works
- Choose the techniques. Use threat intelligence and the MITRE ATT&CK framework to pick the techniques that matter most, often based on a specific threat group, as in adversary emulation.
- Agree the plan. Red and blue agree the scope, the systems involved, the order of techniques and what success looks like.
- Run a technique. The red side executes one technique, such as credential dumping or a remote execution method used for lateral movement.
- Check the defence. The blue side checks whether it was blocked, logged, alerted on and investigated.
- Tune and repeat. If it was missed, the team improves the detection rule, log source or response playbook, then runs the technique again to confirm.
- Record the result. Each technique is tracked as blocked, detected, logged only or missed, building a picture of coverage over time.
Red team vs blue team vs purple team
| Red team | Blue team | Purple team | |
|---|---|---|---|
| Role | Attacks, with permission | Defends | Attack and defence together |
| Way of working | Covert, objective-driven | Continuous monitoring and response | Open, collaborative sessions |
| Main question | Could an attacker reach their goal unnoticed? | Are we detecting and stopping threats? | Which techniques do we detect, and how do we close the gaps? |
| Main output | A realistic view of detection and response | Incidents handled, defences maintained | Improved detections and a coverage map |
Purple teaming does not replace red teaming. Covert red team exercises still test whether the defence works under realistic pressure; purple teaming makes sure the gaps they reveal are fixed quickly.
What purple teaming improves
- Detection coverage: more attacker techniques are reliably detected, mapped against MITRE ATT&CK
- Detection quality: fewer noisy alerts and better context for analysts
- Log sources: gaps in logging are found and filled
- Response playbooks: the team practises how to investigate and contain each technique
- Collaboration: attackers and defenders share knowledge instead of working against each other
Tools used in purple teaming
- MITRE ATT&CK: the common language for planning techniques and reporting coverage
- Atomic Red Team and MITRE Caldera: open-source tools for running individual techniques or full scenarios in a controlled way
- Tracking platforms: tools such as VECTR record which techniques were tested and how the defence responded over time
- Breach and attack simulation: BAS tools automate repeat runs so detections are checked continuously between sessions
When to use purple teaming
- Building or maturing a SOC: to grow detection coverage step by step
- After a red team exercise: to work through the gaps it found and confirm they are closed
- After new security tools are deployed: to check they detect what they are supposed to
- When a new threat appears: to test quickly whether its techniques would be caught
Common challenges
- Becoming a box-ticking exercise: running techniques without real tuning or follow-up
- Unrealistic conditions: a defence that knows exactly what is coming may perform better than it would in a real attack
- Limited scope: testing only well-known techniques can leave gaps elsewhere
- Time and people: sessions need skilled people from both sides at the same time
How Plainsea helps
A purple team is only as good as the techniques it practises against. Plainsea gives it real material: within the scope you set, AI agents find weaknesses, try to exploit them and chain them into attack paths, and every finding is confirmed with evidence of what was done. Your blue team can use those steps to check what was detected and tune its defences, then fixes can be re-tested on demand.