Purple teaming¶

Most of the exercises here put a player against an environment. This one puts two players in the same room, or the same channel: one moving as the attacker, one watching the defences answer. The finding is the distance between what the defence was hoped to catch and what it actually caught.

It runs live or as a tabletop. Live, the attacker makes a real move against a real environment and the defender works the actual detections and the actual response against it, not a described version. As a tabletop, the same move is talked through a step at a time, which loses the live signal but keeps the conversation and costs far less to stage. Either way the value is the same: the two sides read what happened together while the context is still warm, and what did not fire tells as much as what did. What the room records there, what fired and what did not, is the effectiveness evidence an audit leans on: a control seen to produce its intended effect, or not, under a real move rather than on paper.

Played from the attacker’s seat, the honesty is in using only what that position holds and seeing how far it reaches. Played from the defender’s seat, the honesty is in saying in advance what it expects to catch and then facing what it did. The framing, the conditions that decide whether a session teaches or only documents, and the shapes it can take are in purple teaming.

Last updated: 2 July 2026