Why you need to be purple!

 It's Bad

For those who have worked with me for longer periods, you would have heard me say at least once that I don't believe in the commonly prescribed structure of blue and red team operations as much as there are good intentions behind the separation of operations, human behaviour has prevailed and there exists a quite toxic environment between the two (wrongly opposing) sides. This is a direct contradiction to our purpose in cybersecurity which is to harden environments and increase resiliency to cyber-attacks.

We need to change

While purple teaming was not created to replace blue and red operations I have adopted it to do exactly that. Too often I experience clashes between red team operators and defenders whether its online shouting contests or during client engagements behaviour that does not support the iterative improvement of cybersecurity is simply not welcome. Particularly SOC analysts will know this as they will have experienced their fair share of red team engagements and end up in politics and communication nightmares because of poor attitudes on both sides.

We can do it!

With purple teaming, I aim to eliminate this from the industry because purple teaming focuses on working together, delivering new positive improvements for all teams in an engagement and identifying weaknesses and subsequently better protections for organizations. So if that sentence sounds like why you are here in the industry, then you're a purple teamer. Being a purple teamer means we must have strong skills across the spectrum of attack and defence mechanics whether that's having the skills to plan attacks that hold relevance to a business, executing attacks with your own system knowledge or building infrastructure to detect attacks, use cases for new telemetry streams and making architectural recommendations. Beyond attack and defence mechanics we need strong interpersonal skills as its ultimately people sat on seats that are responsible for the different concepts we are looking to enhance with our purple team workshops


Endpoint on Adrenaline : One

Brilliance in the Basics


Endpoint on Adrenaline 3

Writing detections when stuck with EDR

Endpoint on Adrenaline Two

Standardized Note Taking Format For Analysts

Investigate Two

Securing your estate: The First Step