What Is Purple Teaming?
Red plus blue, run together and measured. The purple loop, what to measure (MTTD, coverage, fidelity), and how it differs from a one-off pentest.
Purple teaming isn't a separate team, it's a way of working where offense and defense collaborate in the same session so that every attack technique is instantly checked against your detections.
The purple loop
- Pick a technique or a threat actor's chain to emulate (grounded in ATT&CK).
- Execute it against a representative environment with real telemetry.
- Check what fired: detected, partial, or missed, and how fast (MTTD).
- Tune or write a detection, then re-run to confirm the gap closed.
What to measure
Coverage (share of techniques detected), fidelity (alerts that were true and actionable), and MTTD, mean time to detect, per technique. A single aggregate score hides the technique that took 90 seconds while everything else took two.
Not a pentest
A pentest asks 'can we get in?' Purple teaming assumes an adversary can and asks 'will we see it, and how fast can we respond?' The deliverable is a measured detection posture, not just a list of vulnerabilities.
Stop reading. Start detecting.
Try the interactive kill chain in your browser, no signup, then run the real range.
Next module
The Ransomware Kill Chain, Stage by Stage