DEF CON 33 - Redefining Purple Teaming for Max impact - A Pennington, S Marrone, L Proehl

Purple teaming enhances security through collaboration between red and blue teams, breaking down silos and improving detection and response by simulating real-world adversary behavior. 2:44

Key Takeaways:
• Purple teaming fosters transparency and mutual learning, with both teams planning and executing together, leading to better detection and response skills 3:00.
• Adversary emulation should start small, using threat intelligence or industry-specific threats, and grow from there to ensure realism and relevance 10:24.
• Success is measured by tangible outcomes—such as new detections, documentation, and MITRE ATT&CK coverage—rather than raw counts of exercises 18:45.
• Effective storytelling and executive reporting are essential to justify investments, especially when demonstrating gaps in logging or detection 23:10.

Organizations should begin with foundational security practices before advancing to purple teaming, and smaller teams may benefit from vendor-led services to build capability 29:04.

Sources:

• 2:44 Discussion on the value of collaboration in purple teaming.
• 3:00 Emphasis on shared planning and learning between red and blue teams.
• 10:24 Guidance on selecting realistic adversaries using threat intel.
• 18:45 Metrics for success including new detections and MITRE coverage.
• 23:10 Importance of narrative reporting to executive leadershi