Purple Teaming & Detection Exercises
Detection and response training alongside the attack side
Your detection and response staff train against real attack techniques alongside the attack side, one technique at a time, and fix what was missed on the spot.
This is training together, not an assessment. With your monitoring, detection and response staff, looking at the same records at the same time, we reproduce attack techniques in a controlled way and see how detection, alerts and logs respond. Where something is missed, we adjust detection rules, alert thresholds and protections together, and check again.
When a real attack comes, do our detection and our people catch it and respond?
We train together and fix what was missed on the spot, then set out detection by technique, the rules and settings changed, and the gaps that remain.
Reviewed
When it fits
- Your team needs to face real attacks
You want your monitoring and response staff to see first-hand what real attack techniques look like, and to practise what to check, and whom to pass it to, when an alert comes in.
- Detection has been built or changed
You want to find out, by training with your staff, whether new detection rules, security tools or a new monitoring setup catch real attack techniques.
- Red teaming has shown gaps
Objective-Based Penetration Testing & Red Teaming evaluates how your organisation prevents, detects and responds; this service trains alongside your defence team. You want to work through what the assessment missed, technique by technique, fix it and check it again.
- You need to show what you can detect
You want to set out, technique by technique, what you detect and what you do not yet.
What we look at
For each technique the attack side reproduces, we look together at what the defence side saw and what it missed.
- Detection rules and alerts
Whether an alert fires for each technique, and whether its threshold is right.
- Logs and records
Whether the records needed for detection and investigation are kept, with no gaps in what is collected.
- Security tool settings
Whether tools such as EDR, NDR and SIEM are set up as intended.
- Alert quality
Misses and false alarms, and places where too many alerts bury the ones that matter.
- The first step of response
The person who receives an alert practises what to check and whom to pass it to.
How it runs
Agree techniques and scope
We agree the techniques to train on, the target systems, who takes part and the safety conditions. Techniques can come from threat intelligence or from red team results.
Prepare together
With the defence team we check logs, alerts and detection tools, and agree how things will be recorded.
Reproduce and check
The attack side reproduces a technique in a controlled way; the defence side checks detection, alerts and records on the spot and takes the first response steps.
Tune and check again
Where something is missed, we adjust detection rules, alert thresholds and protections together, and run the same technique again.
Write it up
Results by technique, what was changed, and the gaps and next steps that remain.
When it runs on live systems, the scope, methods and stop conditions are agreed first so that operations are not affected.
What you receive
Detection by technique
Detected, partly detected or missed, for each technique checked.
Rules and settings changed
What was changed during the exercise, and why.
Remaining gaps and priorities
What still cannot be detected, and what to address first.
What to check again
Techniques and criteria to check again after changes, so the next round starts from here.