Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Cybersecurity Teams Are Using Purple Teaming to Bridge Red and Blue
Transcript
- Lucas: If these conversations are useful for what you're building or running, there's one thing to mention before we dig in today. Luna: What's that? Lucas: We keep this show ad-free by design. No sponsor reads, no interruptive ads. If that matters to you, and you want to support the choice, the link is buy me a coffee dot com slash fexingo. Luna: Yeah. It's a small thing that keeps the show exactly what it is. Lucas: Alright — today we are talking about a practice that's quietly reshaping how mature security teams operate: purple teaming. Luna: Which sounds like a sports league crossover. But it's actually the marriage of red and blue teams, right? Lucas: Exactly. Red team is the offensive side — they simulate attackers. Blue team is the defensive side — they monitor, detect, and respond. Historically, these two groups have operated in silos. Red team runs a test, writes a report, throws it over the wall. Blue team may or may not act on it. Luna: And the cycle repeats. I've heard CISOs complain that red team findings often sit for months. Lucas: Right. Purple teaming closes that loop. It's a collaborative, continuous cycle where red and blue work together in real time. The red team runs an attack technique, and the blue team immediately tries to detect it, tune their detections, and validate coverage. It's not a one-off exercise — it's an operating model. Luna: So instead of a report at the end, you get live feedback. That sounds more expensive upfront, but maybe cheaper in the long run. Lucas: That's the argument. And companies like Capital One and JPMorgan Chase have publicly embraced this approach. Capital One, for instance, built an internal platform they call 'Purple Portal' that lets their red and blue teams collaborate on attack scenarios and track detection gaps in near real time. Luna: I remember reading about that. They also open-sourced some of their tooling, right? Lucas: They did. One of the most popular open-source purple teaming frameworks is called Atomic Red Team. It's a library of test cases mapped to the MITRE ATT&CK framework. You can run a specific technique — like 'PowerShell download cradle' — and immediately check if your blue team's sensors catch it. Luna: And there's also Caldera from MITRE itself. That's more of an automated adversary emulation platform. Lucas: Caldera is fantastic for purple teaming because you can define adversary profiles and let the system run through attack chains autonomously. The blue team watches the telemetry as it happens. The feedback loop is hours, not weeks. One CISO I spoke with at a healthcare system told me they found a critical Active Directory misconfiguration during a purple team exercise — one that had been missed by three consecutive red team reports. Luna: Because the red team had flagged it, but the blue team never understood why it was dangerous. In a purple team setting, they see the attack live and internalize the risk. Lucas: That's exactly the cultural benefit. It's not just about finding gaps — it's about building shared context. The blue team learns how attackers think, and the red team learns what detection constraints look like on the ground. Over time, the whole team gets faster. Luna: And the metrics shift, too. Instead of counting findings, you start measuring mean time to detect, or MTTD, and coverage percentage against the MITRE framework. Lucas: Right. Many firms now aim for at least 80 percent coverage across the top 100 attack techniques. And they run purple team exercises quarterly as a minimum. Some do it weekly for critical systems. The goal is continuous validation, not point-in-time certification. Luna: But is this realistic for smaller companies? If you're a fifty-person startup with one part-time security person, purple teaming sounds like a luxury. Lucas: It's a fair point. The tooling helps — Atomic Red Team is free, and Caldera is free. But you still need someone to interpret the results and tune the detections. For smaller teams, managed purple teaming services are popping up. Third-party firms come in, run the exercises, and hand you a prioritized list of detection gaps. That can cost a few thousand dollars per engagement, which is much less than hiring a full-time red teamer. Luna: So it's accessible if you're intentional. And the ROI is clearer than traditional red teaming because you're not just finding vulnerabilities — you're proving your defenses work or don't work. Lucas: Exactly. And that's what CISOs are starting to demand. They don't want a report that says 'you have 47 critical findings.' They want to know: if an attacker uses this specific technique, will we see it? Purple teaming answers that question with evidence. Luna: And it's not just for technical teams. I've seen boards ask for purple team results as part of quarterly risk reporting. The visual of 'we tested 200 attack techniques and detected 185' is much more concrete than 'we have a mature security program.' Lucas: That's a great point. It turns security into a measurable function. And the trend is accelerating. Gartner recently predicted that by 2027, 50 percent of large enterprises will use purple teaming as a primary validation method. Right now, it's probably closer to 20 percent. So there's a lot of room to grow. Luna: What does a typical purple team exercise look like day-to-day? I imagine it's not just running tools. Lucas: No, it's a structured process. Typically you start with a planning phase where red and blue agree on the scope — which systems, which attack scenarios, what 'success' looks like. Then the red team executes the techniques, often in a staging environment first, while the blue team monitors with their production tools. If the blue team detects the activity, they document the detection source and time. If they miss it, they tune their rules and try again. Luna: So it's iterative. You might run the same technique three or four times in one session until detection is consistent. Lucas: Exactly. And at the end, you have a clear inventory: techniques that are fully covered, partially covered, and not covered at all. That becomes the blueprint for the next sprint. One financial services firm I know runs a two-week purple team sprint every quarter. They tackle ten to fifteen techniques each time. Over a year, they've covered about sixty high-priority techniques. Luna: And the cultural side — does it require a specific personality type on the blue team? Some defenders can feel threatened when red team finds gaps. Lucas: That's a real challenge. The best purple teaming programs frame it as a team sport. It's not 'red team beat blue team.' It's 'we found a gap together, and we closed it together.' Some organizations even rotate roles — blue team members spend a week on the red team, and vice versa. That builds empathy. Luna: I've seen that called 'purple teaming as a culture,' not just an exercise. Lucas: Yes. And the metrics reinforce that. Instead of red team 'destroying' blue team, you track things like 'detection improvement rate' or 'time to detection closure.' One healthcare company I work with reduced their mean time to detect from 14 days to under 4 hours over six quarterly purple team cycles. Luna: That's a massive improvement. And it's not just about speed — it's about confidence. If you know your detection coverage, you can make better decisions about risk acceptance. Lucas: Right. And that's where the business case lands. Purple teaming isn't a cost center — it's an insurance policy that you can measure. Every gap you find and close is one less opportunity for an attacker. In a world where breaches cost millions, that's a compelling argument. Luna: Especially when you tie it to cyber insurance. Some carriers are now asking for evidence of continuous testing, not just annual penetration tests. Lucas: That's a trend we're tracking closely. If you can show a carrier that you run quarterly purple team exercises with measurable coverage improvement, you may get a premium discount. It shifts the conversation from compliance to resilience. Luna: So for any security leader listening — what's one thing they can do this week to start moving toward purple teaming? Lucas: Download Atomic Red Team. Pick three techniques from the MITRE ATT&CK top ten — say, PowerShell execution, credential dumping, and spear phishing link. Run them in a test environment with your blue team watching. See what fires. Then tune and rerun. That's a purple team exercise. It doesn't have to be perfect out of the gate. Luna: Start small, build the muscle. And track everything. Lucas: Exactly. Because the data you collect in that first hour is more valuable than a hundred-page red team report from six months ago. It tells you what's actually working right now. Luna: And that's the real point of purple teaming — it's not about proving you're secure. It's about knowing where you're vulnerable and closing the gap before an attacker does. Lucas: Well said. That's the show for today. If you want to see how your own detection stack holds up, give it a shot. And we'll be back next time with another angle on cybersecurity business.