Purple team
A collaborative exercise where attackers and defenders work together, testing detection technique by technique.
Rather than a covert engagement revealed at the end, the offensive side executes a known technique while the defensive side watches to see whether it is detected, then the gap is fixed and the test repeated.
It produces more improvement per hour than a covert red team for most organizations, because every gap is closed and verified as it is found.
Where this comes up
Purple team sits inside our penetration testing work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.
Related terms
Red team An adversarial exercise testing whether your detection and response can catch a determined attacker pursuing a specific objective. Blue team The defenders: the people responsible for detecting, investigating, and responding to attacks. Threat hunting Proactively searching your environment for attacker activity that has not triggered any alert. Mean time to detect The average time between a security event starting and someone noticing it.