Group-IB

Cyber security company that offers a purple teaming service alongside threat intelligence, incident response and managed XDR.

Position 2 of 8Last verified: 4 Nov 2026

Visit provider site (opens in a new tab) All rankings

Facts

Facts as published
Headquarters / legal entity Singapore (Group-IB Global Private Limited); regional subsidiaries include Group-IB MEA FZ-LLC Documented Source
Services in the region Offers the service in the region through regional Digital Crime Resistance Centers, including the Middle East and Africa. The launch release is datelined Dubai. Vendor-reported Source
Purple team service Published, as a Purple Teaming service Documented Source
Engagement length, as published One to eight weeks, depending on the scenarios scoped and complexity Documented Source
Delivery model, as published Remote, on site or hybrid Documented Source
Credentials, as published
  • The service page says specialists hold certifications and names none. Vendor-reported Source
  • The page cites a Leader placement in a Gartner Magic Quadrant for Cyberthreat Intelligence Technologies. This is an analyst claim, not an accreditation. Vendor-reported Source

Tags: Documented stated specifically on a first-party or primary page. Vendor-reported a claim by the provider that cannot be checked independently. Not confirmed not verified from a primary source.

Purple team service

[ PUBLISHED ]

Group-IB publishes a Purple Teaming service on its own site and announced it in a press release datelined Dubai. The release is vendor-supplied and was published unedited by ZAWYA.

What it is, as published. A collaborative validation exercise in which offensive and defensive specialists work together in real time. The red team runs adversary scenarios while the client’s defenders monitor, respond and tune detection rules and response playbooks. Scenarios named in the release include ransomware simulations, Active Directory attacks, supply chain compromise and data exfiltration.

Method, as published. Six steps on the service page: collaborative planning, scenario design, controlled execution, detection and response validation, knowledge transfer and findings alignment, and proven readiness. Scenarios are mapped to MITRE ATT&CK techniques.

Length and delivery. One to eight weeks depending on scenarios and complexity; remote, on site or hybrid.

What is absent. Itemised report contents, pricing and UAE regulatory mapping.

Evidence by criterion

Seven criteria, each rated in words. What the levels mean. A level describes what is published, not a finding that a capability is missing.

1. Published methodology [ DOCUMENTED ]

The service page lists six steps, from collaborative planning to knowledge transfer, and states the length and delivery formats. Source

2. Service breadth [ DOCUMENTED ]

The release places the service beside threat intelligence, managed XDR and incident response. Source

3. UAE regional and regulatory fit [ PARTIAL ]

The launch release is datelined Dubai and the service runs through regional centres. No UAE regime is mapped. Source

4. Deliverable specificity [ PARTIAL ]

Outcomes are named (validated controls, improved SIEM and EDR rules, an improvement roadmap), but the contents of the report are not itemised. Source

5. Threat-intelligence and ATT&CK alignment [ DOCUMENTED ]

Scenarios are mapped to MITRE ATT&CK techniques and, per the release, grounded in the provider's own threat intelligence. Source

6. Verifiable credentials [ STATED ONLY ]

The page says specialists hold certifications. It names none and no issuer. Source

7. Live collaboration and retest [ DOCUMENTED ]

Provider experts run the attacks and explain each technique as it unfolds while the client's defenders tune detection rules and response playbooks. A retest is not named. Source

Why this position

Group-IB sits second because its own service page is one of the more specific in this list. It states six steps, a length range, delivery formats and ATT&CK mapping, and it describes defenders tuning detections during the exercise. It sits below the first position on a judgment about the overall case for a UAE buyer, not on the method alone. A buyer who weights published method, ATT&CK mapping and length above everything else could reasonably put it first. What held it back is that report contents are not itemised and no credential is named.

The order is a reasoned judgment, not a sum of the levels. See how the order is decided.

Deliverables as published

No itemised report contents published.

No itemised report contents published. The service page names outcomes only, such as validated security controls, improved SIEM and EDR rules and a structured improvement roadmap.

UAE fit

The service is offered in the region through the provider's regional centres, and the launch release is datelined Dubai.

Limits of public evidence

  • No pricing is published.
  • No UAE regulatory mapping and no named UAE clients.
  • No itemised report contents.
  • The press release copy shows no date. The claim of more than 1,600 investigations since 2003 is vendor-reported.

Best suited for / less suited for

Best suited for

  • Buyers who want a stated method, a length range and ATT&CK mapping
  • Teams that want scenarios drawn from the provider's own threat intelligence

Less suited for

  • Buyers who need UAE regulatory mapping stated up front
  • Buyers who need itemised report contents before first contact

Compare and read on

Compare with

Related guides

Are you this provider? Request a correction. See also all rankings.