University of Sydney Code Library Breach: Disclosed 18 Dec, 2025

Personal details of about 27,500 current and former staff exposed.

18 Dec 2025 - Syd Uni breached
Read more

Turn attack techniques into
stronger detection and response.

Collaborative purple team exercises that test your visibility, improve controls and validate the results.

Build confidence in your defences

Validate visibility

Test whether your SIEM, EDR and other security tools capture the evidence needed to recognise techniques relevant to your environment.
red-purple-teaming@2x

Improve detection

Work alongside our offensive and defensive specialists to identify gaps, tune authorised controls and test whether the changes work.
adversary-simulation@2x

Strengthen your team

Build practical capability through shared working sessions, connecting attacker behaviour to investigation, triage and response decisions.

How the exercise works

We agree the priority techniques, working sessions, access and change authority before the exercise begins.

1. Execute

Run agreed attack techniques relevant to your threats and environment, with attackers and defenders working transparently together.

2. Observe

Review the telemetry, alerts and analyst decisions. Distinguish what was visible, what alerted and what prompted an effective response.

3. Improve

Tune authorised detections and controls, refine response steps and record larger engineering work in an agreed backlog.

4. Retest

Repeat the techniques to validate improvements, document remaining gaps and assign clear action owners.

What you receive

Measured coverage

  • A technique and MITRE ATT&CK coverage matrix.
  • Session notes and evidence showing telemetry, alerts and response observations.

Validated improvements

  • A prioritised detection, telemetry and response backlog with action owners.
  • Retest results and an outcomes report, with updated rules or playbooks where scoped.

Purple teaming questions

When is purple teaming useful?

Use a purple team exercise to validate a new security deployment, assess detection engineering work or test controls after a significant change. Techniques are prioritised around your environment and relevant threats.

Who needs to participate?

Your security analysts and relevant platform owners work with our offensive and defensive specialists. We agree access, working sessions and responsibilities before the exercise so the right people can observe, investigate and improve.

Will you change our security controls?

Only changes within the agreed authority are made, with rollback arrangements defined. Larger engineering work is recorded and scoped separately. Retesting shows whether the agreed improvements deliver the intended result.

How does this differ from red teaming?

Purple teaming is a transparent, collaborative exercise focused on improvement. Red teaming tests what an attacker could achieve against your defences, often with limited defender awareness.

Ready to strengthen detection?

Let’s choose the techniques and outcomes for your purple team exercise.
Plan a purple team exercise