Purple teaming¶

a Mediterranean cleaning station, a dusky grouper hanging still with its mouth open while a cleaner wrasse works inside it. Both Mediterranean, both real, and the station is a loop the pair return to.

Purple teaming is not a third team. It is a way of working in which the offensive and defensive sides run in the same loop, with shared context and real-time talk, instead of as separate exercises whose findings arrive weeks later in a report nobody reads. A red team alone tests defences and hands over a document; the defenders learn what failed and rarely why, because the context is gone by the time it lands. A blue team alone builds detections against the threats it can imagine, and meets the ones it could not the hard way. Run in contact, each side learns while the other is still in the room, and the conditions under which a detection fails become visible to the people who could fix it.

Done well, it replaces what the defences were hoped to catch with what they actually catch, and narrows the gap between finding a weakness and being able to act on it. What emerges over several rounds is coverage that reflects real behaviour instead of configuration intent, a shared vocabulary across the two sides, and investment decided by what the organisation has been shown to be exposed to rather than by what is being sold to it.

Purple teaming can be technically flawless and change nothing at all, and when it does the reason is rarely technical. Three conditions decide whether it produces change or only documentation. Someone, by name, needs the authority and the will to turn a finding into a changed control, a moved budget, a different process; without that, the loop surfaces risk it cannot close. The room needs to be safe enough that a detection found wanting reads as a system to adjust rather than a person to blame, since the first uncomfortable finding sets the pattern for every one after it. And the exercise has to be built to find what the organisation is not ready for, not to confirm what it already knows: a programme designed to succeed will succeed, and teach nothing.

When those conditions hold, the rest is craft. Run as a live or tabletop exercise, the loop sits in the Crucible.

Start the learning loop

Last updated: 2 July 2026