Running the loop

How a purple session runs turns mostly on one choice: how much the defending side knows in advance. That choice sets what the exercise can teach and what it cannot.

Disclosed, the blue side knows an exercise is happening, roughly when, and what techniques are in play, with talk running both ways throughout. It is the gentlest mode and the one that teaches least about a real day, because the day was never realistic; it earns its place for early rounds, for validating a single detection, for bringing new analysts on, for trying a new tool.

Blind, the blue side knows exercises come on some cadence but not the timing or scenario of any one, and the activity is revealed during or just after. It reads detection coverage more honestly, at the cost of some confusion to be managed with a clear channel and an agreed safe word.

Double-blind, the blue side does not know an exercise is running at all, and it comes closest to testing real detection and response, at the highest risk: an inappropriate escalation, a disruption, an analyst’s standing bruised for missing something nobody told them to expect. The disturbance after the reveal is real, and worth budgeting time for rather than filing as a finding.

Continuous, the two sides work together on an ongoing basis, red feeding scenarios, blue tuning detections, automation checking coverage in between; it improves fastest and costs the most, and without the culture and tooling already in place it tends to produce alert fatigue rather than capability.

Many programmes drift from disclosed toward blind toward double-blind, with continuous arriving when resources and culture allow. The progression is not compulsory. Some stay disclosed for years and do excellent work, because the conditions there carry the learning; others reach for double-blind early and buy expensive findings the organisation cannot yet act on. The choice is less about sophistication than about what the programme can hold, technically and culturally.

Whichever mode, the shape of a session is the same. The offensive side moves; the defensive side works live against the actual move rather than a later account of it; and the two read what happened together while the context is still warm. What that produces feeds straight into the reflection and the artefacts the loop leaves behind.

Last updated: 4 July 2026