Red teams find gaps; blue teams close them. Purple teaming puts them in the same room so every attack technique is immediately tested against your detections - and the gaps become fixes, fast.
The loop
- Pick techniques - choose ATT&CK techniques relevant to your threat model (or run a framework like Atomic Red Team).
- Execute safely - red (or an automation tool) runs the technique in a controlled way.
- Check detection - blue looks: did we log it? did a rule fire? was the alert good enough to action?
- Improve - if it was missed, add telemetry or write a detection. If it fired noisily, tune it.
- Re-test - confirm the new detection catches it. Track coverage on the ATT&CK matrix.
Why it beats red-team-only
A red-team report says "we got in." Purple teaming produces detections - durable improvements you keep. It turns a point-in-time test into a measurable, growing coverage map.
Make it repeatable
Automate the technique execution (Atomic Red Team, Caldera), track results (VECTR), and schedule regular runs. The goal isn't "did we get caught once" - it's a rising line on your coverage chart over time.