What does purple team mean?
Purple team work combines attack and defence in one exercise. An attacker-side specialist runs a scenario. A defender watches, notes what the tooling did or did not record, and tunes the detection or response on the spot. The attacker repeats the step.
Why “purple”?
Red is the attacker colour and blue is the defender colour. Purple is what you get when they work together. The word describes a way of working, and a provider may use it for an exercise, a service or a function.
How does it work?
Providers describe a similar loop. The Group-IB service page lists six steps from collaborative planning to knowledge transfer. The Mandiant datasheet describes step-by-step scenario exercises across the attack lifecycle, with coaching on logging, monitoring and alerting when activity is missed. See the step-by-step guide for the full sequence.
| Step | What happens | Who acts |
|---|---|---|
| Plan | Pick scenarios and agree rules | Both sides |
| Execute | Run one technique or stage | Attacker side |
| Observe | Check what was logged and alerted | Defender side |
| Tune | Change a rule, a source or a playbook | Defender side |
| Repeat | Run again and confirm the change | Both sides |
Who benefits?
Teams that already have something to tune: log sources, an EDR or SIEM, and people who can change detections. Paranoid Security’s cyber exercises page names organisations with their own SOC as its audience, and the Group-IB profile describes defenders tuning rules during the engagement.
Permanent team or exercise?
Treat it as an exercise with a start, an end and a report, unless you build a standing programme around it. That choice is covered in continuous vs one-off purple teaming.
The ranking of providers that publish such a service is on the home page. The criteria used to read their evidence are on the methodology page.