Mandiant (Google Cloud)
Incident response and threat intelligence team within Google Cloud that publishes Purple Team Assessment datasheets.
Facts
| Headquarters / legal entity | Part of Google Cloud; headquarters and contracting entity not stated Not confirmed |
|---|---|
| Services in the region | Offers services in the region. The datasheet is a global document, so confirm UAE delivery and data-residency terms before engaging. |
| Purple team service | Published, as the Purple Team Assessment and a Continuous Purple Team Assessment Documented Source |
| Engagement length, as published | About three weeks in total, two weeks of testing and one week to assemble and deliver the report Documented Source |
| Delivery model, as published | A Mandiant incident response consultant and a red team consultant work with the client's security team at each phase. On-site or remote delivery is not stated. Documented Source |
| Credentials, as published |
|
Tags: Documented stated specifically on a first-party or primary page. Vendor-reported a claim by the provider that cannot be checked independently. Not confirmed not verified from a primary source.
Purple team service
[ PUBLISHED ]
Mandiant, part of Google Cloud, publishes two datasheets: a Purple Team Assessment and a Continuous Purple Team Assessment.
What it is, as published. A scenario-based, collaborative assessment of how a security team prevents, detects and responds to attacks. It starts from intelligence on the threat groups most active in the client’s industry, builds validation content from their techniques, and runs step-by-step exercises across the attack lifecycle. The datasheet contrasts it with an adversarial penetration test, because the purple team does not assume that security operations work as intended.
How the client takes part. The client’s security team works directly with a Mandiant incident response consultant and a red team consultant at each phase. Detected activity leads to checks that a response procedure exists. Missed activity leads to coaching on logging, monitoring and alerting before the next attempt.
Length. About three weeks: two weeks of testing and one week to assemble and deliver the report.
Continuous variant. A separate datasheet describes coaching sessions at regularly scheduled intervals.
What is absent. UAE-specific delivery terms, UAE regulatory mapping and pricing.
Evidence by criterion
Seven criteria, each rated in words. What the levels mean. A level describes what is published, not a finding that a capability is missing.
The datasheet describes the approach from intelligence on active threat groups to validation content, with step-by-step scenario exercises across the attack lifecycle and a stated timeline. Source
The datasheet draws on incident response, red team and threat intelligence experience; a continuous variant adds coaching sessions at scheduled intervals. Source
The datasheet is a global document. It gives no UAE-specific delivery terms or regime mapping. Source
The datasheet itemises a scorecard of detection metrics, an executive summary, a technical walkthrough with steps to recreate findings, evidence-supported findings with remediation, and strategic recommendations. Source
The datasheet says the assessment aligns with the MITRE ATT&CK framework, maps scenarios across the attack lifecycle, and starts from intelligence on threat groups active in the client's industry. Source
No accreditation or certification is named in the datasheet. Source
Consultants work with the client's security team at each phase. Missed activity leads to coaching on logging, monitoring and alerting before the next simulation attempt. No separate retest is named. Source
Why this position
Mandiant sits third because its datasheet is among the most specific public descriptions of a purple engagement in this list. It gives a method, ATT&CK alignment, a three-week length and an itemised report. It sits below the two providers above on a judgment about a UAE buyer. The datasheet is a global document with no UAE-specific delivery terms or regime mapping. Read the position as a prompt to confirm UAE delivery arrangements, not as a finding about delivery quality.
The order is a reasoned judgment, not a sum of the levels. See how the order is decided.
Deliverables as published
- A scorecard of metrics on detection of the simulated incidents
- An executive summary
- A walkthrough of technical details and capability evaluation, with steps to recreate the findings
- Evidence-supported findings and remediation strategies
- Strategic recommendations for long-term operational improvement
- Technical-level and executive-level briefs on request
UAE fit
The provider offers services in the region. The datasheet is a global document.
Limits of public evidence
- No pricing is published.
- No UAE-specific delivery terms or regulatory mapping are published.
- The datasheets are marketing documents.
Best suited for / less suited for
Best suited for
- Buyers who want a published method, ATT&CK alignment and an itemised report
- Teams that want incident response and red team consultants working together at each phase
Less suited for
- Buyers who need UAE delivery and regulatory mapping confirmed in public sources
- Buyers who need a named accreditation they can check with the issuer
Compare and read on
Are you this provider? Request a correction. See also all rankings.