What Is a Purple Team Exercise?
On this page
A purple team exercise has attackers and defenders work together to improve detection — the practical realization of the purple team idea. Instead of red versus blue as a contest, the two sides collaborate openly: red runs a technique, blue checks whether they can see it, and detections get tuned on the spot. The output is not a winner but a measurably better defense.
How it works#
The exercise is a tight collaborative loop:
- Pick a technique — often a specific MITRE ATT&CK technique relevant to your threats.
- Red executes it openly, explaining what they are doing.
- Blue watches — does the detection fire? Is the telemetry there?
- Tune on the spot — if it was missed, build or fix the detection immediately.
- Repeat across techniques, recording new coverage.
Because it is collaborative, nothing is hidden — the point is to find and fix detection gaps, not to score points.
Why collaboration beats competition#
A traditional red-vs-blue contest can leave the blue team beaten and no wiser. Purple teaming turns each attack into a lesson:
| Red vs blue (contest) | Purple (collaboration) |
|---|---|
| Red “wins” silently | Every technique teaches blue |
| Gaps stay hidden | Gaps are found and fixed |
| Adversarial | Shared goal |
| Ends with a result | Ends with better detection |
Purple teaming turns offense and defense into a single improving system. More at the Careers & Practice hub.
Frequently asked questions#
What is a purple team exercise?
A purple team exercise is a collaborative session where offensive (red) and defensive (blue) practitioners work together in real time: the red side runs attack techniques while the blue side watches whether their detections fire and tunes them on the spot. The goal is measurable improvement in detection and response, not a win-or-lose contest.
How is a purple team exercise different from a red team engagement?
A red team engagement is adversarial and often covert — the red side tries to achieve objectives without being caught, and the blue side may not know it is happening. A purple team exercise is openly collaborative: both sides work together, sharing what they do and see, to directly improve the blue team’s detection capabilities.