GUIDE · Red and Purple Teaming
Test Your Defenses Against a Realistic Adversary.
Red teams emulate attackers end to end; purple teams work with your defenders to turn every technique into better detection.
- Proof of detection and response capability
- Tuned detections
- Prioritized improvements
- 1Define Threat Profile
- 2Set Objectives and Rules
- 3Run the Emulation
- 4Replay with Defenders
- 5Report and Retest
Executive Summary
- 01Red teaming measures whether an attacker can reach a defined objective, and purple teaming measures and improves whether defenders can see the path.
- 02Each technique is most useful when recorded as detected, logged only, or missed.
- 03The value lies in verified fixes and retests, not in a long list of findings.
The Challenge
Controls that pass audits can still fail against a determined adversary who combines phishing, credential theft and lateral movement.
Security teams rarely get to see how their detection performs under realistic pressure.
The DAAKYI Approach
DAAKYI plans objective‑based campaigns that mirror the threats facing your sector, then measures what was detected, how quickly and where response broke down.
Purple-team sessions convert results into tuned detections with your SOC.
- 01
Threat-informed campaign planning
- 02
Objective-based red team execution
- 03
Purple-team detection workshops
- 04
Executive debrief
In Depth
How the Discipline Works
Scope Starts with Objectives
A red team exercise begins with a question, not a toolset. Leaders decide which outcomes would hurt most, such as unauthorized payment instructions, access to a citizen records system, or loss of domain administrator control. Those objectives become the finish line. Operators then select adversary behaviors that plausible threat groups use against the sector, mapped to MITRE ATT&CK tactics and techniques. Rules of engagement set boundaries: systems that are off limits, hours of activity, escalation contacts, and conditions that pause the test. Because the exercise tests people and process as well as technology, the plan also defines who inside the organization knows about it.
Execution Follows the Attack Path
Execution chains small steps into a realistic intrusion. An operator might send a pretext email, capture a credential, reach a workstation, escalate privileges, move laterally, and then stage the objective. Each step is chosen to look like real adversary tradecraft, and each is logged with time, technique, and the control it met. The log matters as much as the outcome. A red team that reaches its objective proves exposure. A red team that is caught at the second step proves detection works, and shows exactly where. Operators adapt when blocked, because real attackers do, but they stay inside the agreed rules at all times.
Purple Teaming Closes the Loop
Purple teaming replays techniques with defenders watching. The red operator runs a technique, the SOC analyst checks whether telemetry arrived, whether a rule fired, and whether the alert made sense. If not, the team fixes it on the spot: a new log source, a revised query, a tighter threshold, an updated runbook. Then the technique runs again to confirm the fix. This repeat-and-verify cycle turns a finding into a working detection rather than a report entry. It also trains analysts on what real activity looks like in their own tooling, which is difficult to learn from vendor documentation alone.
A red team shows how far an attacker can get. A purple team makes sure they cannot do it quietly twice.
Capability Matrix
What the Service Includes
| Capability | Coverage | GUIDE | SECURE | OPERATE | Delivered Through |
|---|---|---|---|---|---|
| Red Teaming | Full-scope adversary emulation. | GUIDE stage | – | – | Advisory Engagements |
| Purple Teaming | Collaborative detection improvement. | GUIDE stage | – | – | Advisory Engagements |
| Social Engineering | Phishing and pretexting within scope. | GUIDE stage | – | – | Advisory Engagements |
| Detection Tuning | Use cases refined with your defenders. | GUIDE stage | – | – | Advisory Engagements |
Red Teaming
Full-scope adversary emulation.
- Stage
- GUIDE
- Delivered Through
- Advisory Engagements
Purple Teaming
Collaborative detection improvement.
- Stage
- GUIDE
- Delivered Through
- Advisory Engagements
Social Engineering
Phishing and pretexting within scope.
- Stage
- GUIDE
- Delivered Through
- Advisory Engagements
Detection Tuning
Use cases refined with your defenders.
- Stage
- GUIDE
- Delivered Through
- Advisory Engagements
How It Works
How Red and Purple Teaming Works
- 01Plan
- 02Emulate
- 03Detect
- 04Improve
Methodology
The Method, Step by Step
- 1
Define Threat Profile
Identify the adversaries most relevant to the sector and region, their usual entry methods, and their goals. Translate this into a short list of ATT&CK techniques to emulate. The profile keeps effort tied to credible risk instead of a generic checklist of tricks.
- 2
Set Objectives and Rules
Agree on crown-jewel targets, success criteria, permitted techniques, and out-of-scope systems. Name a small control group that can deconflict activity and stop the test if real incidents or safety concerns appear. Document legal authorization before any operator touches production systems or staff.
- 3
Run the Emulation
Operators gain initial access, establish persistence, escalate, and pursue objectives while recording every action with timestamps. They use infrastructure and tradecraft that resemble the chosen adversary. The defenders' reactions, including alerts, tickets, and escalations, are captured alongside the offensive timeline for later comparison.
- 4
Replay with Defenders
Reveal the timeline and walk through each technique with the SOC. For every gap, determine whether the cause was missing telemetry, a weak rule, an unclear playbook, or slow handoff. Re-run the technique after each change to verify the detection now fires and the analyst knows what to do.
- 5
Report and Retest
Compile findings against the original objectives, ranked by the risk they represent and the effort to fix. Assign owners and dates. Schedule a retest of unresolved items so leadership can see whether exposure and detection coverage have actually changed, not just whether tasks were closed.
Operating Model
Delivered from the GUIDE Pillar
Pillar position
GUIDE
Advisory, Risk & Assurance
Engagement model
Advisory Engagements
Fixed-scope assessments, strategy, compliance and testing.
Best for · Defined questions with a clear deliverable
Threat Scenarios
What It Looks Like in Practice
Phishing to Credential Theft
How It Shows Up
A staff member enters credentials on a fake login page, and the attacker signs in from an unfamiliar location minutes later.
Response
Emulate the lure and the sign-in, then check whether mail filtering, identity logs, and conditional access raised alerts.
Lateral Movement with Stolen Admin Credentials
How It Shows Up
Remote service logons and administrative share access appear from a workstation that never performed such actions before.
Response
Replay the movement techniques and tune detections around account behavior rather than known tool signatures.
Ransomware Precursors
How It Shows Up
Backup deletion, security tool tampering, and bulk file access occur outside business hours.
Response
Emulate the pre-encryption sequence safely and verify that alerts trigger containment before any data is encrypted.
Cloud Identity Abuse
How It Shows Up
A service principal or access key is used to enumerate storage and create new credentials.
Response
Test control plane logging and alert logic, and confirm responders know how to revoke tokens and keys.
| Scenario | How It Shows Up | Response |
|---|---|---|
| Phishing to Credential Theft | A staff member enters credentials on a fake login page, and the attacker signs in from an unfamiliar location minutes later. | Emulate the lure and the sign-in, then check whether mail filtering, identity logs, and conditional access raised alerts. |
| Lateral Movement with Stolen Admin Credentials | Remote service logons and administrative share access appear from a workstation that never performed such actions before. | Replay the movement techniques and tune detections around account behavior rather than known tool signatures. |
| Ransomware Precursors | Backup deletion, security tool tampering, and bulk file access occur outside business hours. | Emulate the pre-encryption sequence safely and verify that alerts trigger containment before any data is encrypted. |
| Cloud Identity Abuse | A service principal or access key is used to enumerate storage and create new credentials. | Test control plane logging and alert logic, and confirm responders know how to revoke tokens and keys. |
Outcomes
What Your Institution Gains
- Proof of detection and response capability
- Tuned detections
- Prioritized improvements
Deliverables and Roles
What You Receive, and Who Does What
| Deliverable | Purpose |
|---|---|
| Rules of Engagement Document | Records scope, authorization, boundaries, and stop conditions before any activity begins. |
| Attack Timeline | Provides an ordered record of each technique, its time, and the defender reaction. |
| Detection Coverage Matrix | Maps techniques to telemetry, analytic, and response outcomes so gaps are visible. |
| Tuned Detection Content | Delivers new or revised rules, queries, and playbooks that were verified by replay. |
| Executive Report and Remediation Plan | Ranks findings by risk, with owners and retest criteria for leadership decisions. |
| Role | Responsibility |
|---|---|
| Executive Sponsor | Approves objectives and risk tolerance and authorizes the exercise in writing. |
| Control Group Lead | Knows the exercise is underway, deconflicts suspicious events, and can pause activity. |
| Red Team Operator | Executes the emulation within the rules and records every action and result. |
| SOC Detection Engineer | Builds and tunes detections and confirms they fire when techniques are replayed. |
Maturity Model
Where Organizations Typically Stand
Stage 1
Ad Hoc
Testing is limited to periodic scans, and detection performance against attacker behavior is unmeasured.
Stage 2
Scripted
Individual techniques are tested against known detections, often by defenders alone and with limited threat context.
Stage 3
Threat‑Informed
Exercises follow sector-relevant adversary behavior, and results feed detection tuning in a repeatable cycle.
Stage 4
Continuous
Techniques are replayed regularly, coverage is tracked on a matrix, and red team findings drive engineering priorities.
Frameworks and Regulation
The Standards That Shape This Work
MITRE ATT&CK
Enterprise ATT&CK organizes adversary behavior into 14 tactics with techniques and sub-techniques. It gives red and purple teams a shared language for planning emulation and measuring coverage.
NIST CSF 2.0
Its six functions are Govern, Identify, Protect, Detect, Respond, and Recover. Exercises produce evidence mainly for Detect and Respond, and inform Govern decisions on priorities.
ISO/IEC 27001:2022
Annex A lists 93 controls in four themes: organizational, people, physical, and technological. Exercise results show whether technological controls such as monitoring work in practice, with ISO/IEC 27002:2022 supplying guidance.
NIST SP 800-61
This incident handling guide helps teams judge whether detection, analysis, containment, and escalation steps work as documented when a realistic intrusion unfolds.
Buyer Guidance
Choosing the Right Provider
What to look for
- Look for objective-based scoping tied to business outcomes rather than a fixed list of tools.
- Look for operators who can explain each technique in ATT&CK terms and show how it is recorded.
- Look for clear rules of engagement, including a control group, stop conditions, and artifact clean-up.
- Look for deliverables that include verified detection improvements and a retest, not only a findings report.
Questions to ask a provider
- How do you choose which adversary behaviors to emulate for our sector?
- How do you protect production systems and data during the exercise?
- How will you show which techniques were logged, alerted, and acted upon?
- What happens after the report to confirm that fixes actually work?
Regulatory & Industry Context
The Obligations This Service Supports
Exercises test the detection and response controls expected by NIST CSF and ISO/IEC 27001, and support threat-led testing expectations in financial services.
Frameworks DAAKYI helps clients implement
- NIST CSF
- ISO/IEC 27001
Framework references describe client implementation support, not DAAKYI certifications.
Technical Detail
For Architects and Security Leads
Framework and regulatory alignment
- NIST CSF
- ISO/IEC 27001
Exercises test the detection and response controls expected by NIST CSF and ISO/IEC 27001, and support threat-led testing expectations in financial services.
Architecture reference
How Red and Purple Teaming Works: Plan → Emulate → Detect → Improve.
DAAKYI plans objective-based campaigns that mirror the threats facing your sector, then measures what was detected, how quickly and where response broke down.
Mapping Detection Coverage to ATT&CK
MITRE ATT&CK Enterprise organizes adversary behavior into 14 tactics, each containing techniques and sub-techniques. Purple teams use it as a shared vocabulary. Every executed technique is recorded with three results: was telemetry generated, did an analytic fire, and did a human act. A technique can fail at any layer. Endpoint logging may be disabled, a rule may match only a tool name rather than the behavior, or an alert may sit unreviewed in a queue. Plotting these results on a coverage matrix shows where visibility is absent versus where logic is brittle. Prioritize techniques seen in your sector, because uniform coverage across every cell is neither realistic nor necessary.
Rules of Engagement and Safe Operation
Safe execution depends on controls built into the test. Operators use dedicated accounts and tagged infrastructure where possible so a control group can separate exercise activity from genuine intrusions. Payloads are inert or reversible, and data exfiltration uses synthetic or approved samples rather than live customer records. A deconfliction channel lets the control group confirm whether a suspicious event belongs to the exercise. If defenders escalate to law enforcement or a regulator, the control group must be able to halt and clarify quickly. Written authorization should cover third-party hosted systems, since cloud and service providers often have their own testing conditions. Operators also keep a clean-up log to remove every artifact afterward.
Glossary
Key Terms
- Adversary Emulation
- Reproducing the documented behavior of a specific threat actor to test defenses against realistic tactics.
- Control Group
- The small group that knows about the exercise, deconflicts activity, and can stop it.
- Deconfliction
- The process of determining whether a suspicious event belongs to the exercise or to a real attacker.
- Detection Coverage
- The share of relevant techniques for which telemetry, analytics, and response all work as intended.
Related
Explore Connected Capabilities
Proof Points
What We Can Stand Behind
- Every stage of DAAKYI's delivery methodology produces documented, auditable deliverables.
FAQ
Questions Leaders Ask
DAAKYI Intelligence
Ask Kasara About Red and Purple Teaming
Kasara, our AI assistant, answers from DAAKYI's published content and can connect you with a specialist.
Next Step
Discuss Red and Purple Teaming with DAAKYI
Tell us about your environment and obligations. A DAAKYI specialist for Red and Purple Teaming will respond.
Request a Security Assessment