Purple team exercises

A joint exercise: our operators execute attack techniques one by one while your defenders tune detection and response.

Adversary simulation

A red team operation tells you what the defenders missed. A purple team exercise makes sure they do not miss it again. Attackers and defenders sit at the same table: a technique is executed, the defenders look for it in their tools, and if it is not there, a rule is written and the technique is executed again.

The exercise is built from the techniques of the adversaries relevant to your sector. Nothing is hidden and nobody is scored. Success is measured by the number of techniques that went from invisible to detected while the exercise lasted.

01Scope

What we test

  • Selection of techniques used by the adversaries relevant to your sector
  • Execution on workstations, servers, identity systems and cloud
  • Telemetry: whether the activity is recorded at all
  • Detection: whether a rule fires, how late and with what context
  • Response: triage, containment, escalation
  • Tuning of rules and reduction of false positives
  • Test scripts handed over for regression

02Approach

How the work is done

  1. Planning

    Adversaries and techniques are selected together with your defenders. The environment is agreed: production systems with production telemetry wherever possible.

  2. Execution

    Techniques are executed one at a time and announced in advance. Destructive effects are simulated, never produced.

  3. Detection review

    After each technique the defenders check what their tools recorded. Missing telemetry and missing rules are fixed on the spot and the technique is repeated.

  4. Report

    A coverage matrix shows every technique before and after the exercise, with the rule that now detects it.

Methodology

03

What you receive

  • Coverage matrix mapped to MITRE ATT&CK, before and after
  • Detection rules in the format of your tools
  • Scripts that reproduce each technique for regression testing
  • Executive summary for management
  • Technical report: every finding with evidence, CVSS 4.0 vector, CWE class and fix
  • Debrief call with your engineers
  • One retest of every finding within 60 days of the report
  • Attestation letter after the retest

04

What we need from you

  • Your detection and response team, in-house or outsourced, available for the exercise
  • Access of the defenders to their monitoring consoles during the sessions
  • Hosts that represent production: workstation, server, cloud account
  • Approval of the list of techniques by the owner of the systems

05Standards

Standards behind the method

06Questions

Questions about this service

How does it differ from a red team operation?

A red team operation is covert and driven by an objective; it tests the organisation as a whole. A purple team exercise is open and driven by techniques; it improves detection. The exercise often follows an operation to close the gaps the operation found.

Monitoring is outsourced to a provider. Can they take part?

Yes, and they should. The exercise shows what your provider actually sees, which is rarely visible from the contract.

Is the exercise run in production?

Where possible, because that is where detection has to work. Techniques are selected and configured so that they cause no harm; anything destructive is simulated.

08Request

Tell us what needs testing

  • Website check free of charge
  • Reply within 1 business day
  • NDA before any technical detail
  • Fixed price for paid engagements
  • No obligation

Request an assessment

Describe the systems and the goal. A manager replies within 1 business day with clarifying questions and the next step.

Who to reply to

We reply to this address unless you choose another channel.

A sole proprietor writes their own name.

Preferred channel
What to assess
Services of interest

Choose all that apply.

Free check

We check your website free of charge

If we find no problems, you receive the report free of charge as well. You pay for the report only when we find problems, and its price depends on their number and severity.

Terms of the free website security check

Application security

Infrastructure and cloud

Adversary simulation

AI, Web3 and cryptography

Programs and assurance

Application security

Free website security check

We look at your website from the outside, the way an attacker does, and check whether it can be broken into: weak settings, outdated software, exposed files, unsafe forms. The check is free of charge.

Application security

Web application penetration testing

We try to break into your web application the way a real attacker would: log in to the accounts of other people, read the data of other customers, change prices or orders. You learn what is possible before criminals do.

Application security

API security testing

An API is the channel through which your app, your website and your partners exchange data with your servers. We check that nobody can use it to read or change data that is not theirs.

Application security

Mobile application penetration testing

We examine your iOS or Android app and the servers behind it: what the app keeps on the phone, what can be extracted from it and whether its requests can be tampered with.

Application security

Secure code review

Our specialists read the source code of your product and find the mistakes that lead to a break-in, including those that cannot be seen from the outside.

Infrastructure and cloud

Cloud & Kubernetes security assessment

We check how your cloud is set up (AWS, Azure, Google Cloud, Kubernetes): who has access to what, which data is open to the internet and how far an attacker gets after the first mistake.

Infrastructure and cloud

Infrastructure penetration testing

We test your servers and your office network from the outside and from the inside: can an attacker get in, and once inside, reach the accounting system, the mail or the backups.

Infrastructure and cloud

External attack surface assessment

We find everything your company exposes to the internet, including what has been forgotten: old websites, test servers, leaked passwords. Then we show which of it can be attacked.

Infrastructure and cloud

CI/CD & supply chain security

We check the path your code takes from the developer to the customer: build servers, third-party libraries, access keys. Whoever controls that path controls your product.

Adversary simulation

Red team operations

A full-scale exercise. Our team plays a real attacker with a goal, for example to reach customer data, and you see whether your defence notices and stops it.

Adversary simulation

Purple team exercises

Our attackers and your defenders work side by side: we show an attack technique, your team checks whether it sees it, and the gaps in monitoring are closed on the spot.

Adversary simulation

Social engineering assessment

We test people, not machines: the phishing emails, calls and messages that attackers use to obtain passwords. You learn how many employees would be deceived and what to train.

AI, Web3 and cryptography

AI & LLM security testing

If your product has a chatbot or another AI model, we check whether it can be talked into revealing confidential data, breaking its own rules or acting on behalf of someone else.

AI, Web3 and cryptography

Smart contract audit

Before a smart contract holds money, we look for mistakes in its code that would let someone withdraw or freeze the funds. After deployment such mistakes cannot be corrected.

AI, Web3 and cryptography

Cryptography review

We check how your product encrypts data and protects keys: whether the right algorithms are chosen and whether they are applied correctly. A mistake here makes the encryption useless.

Programs and assurance

Bug bounty program management

A bug bounty is a program in which independent researchers look for vulnerabilities in your product and are paid for each one they find. We launch and run such a program for you.

Programs and assurance

Vulnerability disclosure program (VDP)

A public page and a procedure that tell researchers how to report a vulnerability to you safely. Without them reports get lost or arrive as threats. We set the process up and handle incoming reports.

Programs and assurance

Continuous penetration testing

Instead of one test a year, we test every significant change of your product throughout the year, so that a new vulnerability does not wait for months to be found.

Programs and assurance

Compliance-driven penetration testing

A penetration test arranged so that an auditor, a regulator or a large customer accepts its report: PCI DSS, DORA, NIS2, ISO/IEC 27001, SOC 2.

Services of interest

Not sure yet

Choose this if you do not know which service you need. Describe the task in your own words, and a specialist will suggest the service in the reply.

Domain or URL of the website or of the main system to test, for example app.example.com.

What needs testing, why now, and any deadline or compliance requirement. No passwords, keys or vulnerability details.

Confirmations

Do not send credentials, keys or details of a vulnerability through this form. A secure channel is agreed after the first reply.

Automated abuse check