Redguard AG - Purple Teaming

Collaboratively identify and close gaps in your detection.

Purple Teaming is a collaborative and highly efficient approach to continuously review and improve your cyber security detection. Our simulated adversary team (Red Team) and your defense team (Blue Team or SOC) work hand-in-hand as a unified "Purple Team". Together, we execute real-world attack techniques, verify the response of your security controls in real-time, and optimize your detection mechanisms directly on site.

Request offer

Selected references on the subject

Why Purple Teaming?

Compared to traditional security assessments, Purple Teaming offers a direct, measurable improvement to your detection capabilities. Instead of simply uncovering vulnerabilities, attackers and defenders work together to close detection gaps immediately and maximize the efficiency of your Security Operation Center (SOC).

Direct Detection Improvement

Traditional security reviews such as penetration tests or attack simulations reveal vulnerabilities, but often test detection capabilities passively or after the fact. In a Purple Teaming exercise, every executed attack technique is cross-referenced in real-time with the alerts generated in your SIEM or EDR. This immediately determines whether an attack was detected, allowing the corresponding detection rule to be adjusted on the spot.

Targeted Training for Your Blue Team

Your defense team benefits directly from our attackers' expertise. By collaboratively going through real-world attack methods, the Blue Team learns exactly what advanced cyber threats look like within network and system logs. This massively strengthens their triage, analysis, and rapid response skills during an actual security incident.

Alignment with Proven Frameworks

We align our testing with globally established standards such as the MITRE ATT&CK Framework. This enables systematic coverage and measurement of your detection maturity across the entire attack chain, helping to identify specific gaps in alerting, triage, and escalation.

Differences to Attack Simulation and Red Teaming

The aim of an Attack Simulation is to uncover security gaps and vulnerabilities that are particularly relevant for you and your company. As with Red Teaming, a real attacker is simulated, but for reasons of efficiency, no consideration is given to any detection and response capabilities.

In contrast, Red Teaming takes existing detection and response processes into account by carefully weighing up and selecting the chosen attack techniques before execution in order to remain undetected as an attacker for as long as possible. This also uncovers and exploits vulnerabilities and security gaps, but the main focus is on testing your company's existing detection and response capabilities.

Possible scenarios of a purple teaming

To targetedly test the detection mechanisms of your protective systems, we offer various scenarios tailored to your environment. These can be individually combined or expanded.

Microsoft Network

In this scenario, detection mechanisms within your local Microsoft network (Active Directory, Windows clients, and servers) are tested. We simulate realistic attack paths such as privilege escalation and lateral movement to close blind spots.

Ransomware

In this scenario, detection mechanisms in your environment are tested with a focus on ransomware. We evaluate detection rates for data encryption, exfiltration, and command-and-control activities.

Microsoft Azure / O365

In this scenario, detection mechanisms in your Azure tenant and Microsoft 365 environments are tested. We simulate cloud-specific attack vectors such as compromised identities and unauthorized app permissions.

Custom Scenario

In this scenario, detection mechanisms are tested according to your individual requirements. We develop tailored simulations that are exactly aligned with your specific IT landscape.

Workflow of a purple teaming

Our Purple Teaming follows a structured, iterative five-phase process that ensures maximum efficiency and transparency:

Results

As a result of a Purple Teaming, you will receive the following deliverables from us: A detailed technical report covering all tested use cases and their results, as well as a chronological list of all executed actions.

Crucial to the success of the entire project is the close partnership between our Red Team and your Blue Team: Your Blue Team prepares the technical prerequisites and actively participates in the selection, execution, evaluation, and discussion of the use cases, and analyzes security alerts in real-time.