What is a Purple Teaming session?
In a Capture the Flag (CTF) exercise, two teams compete against each other. The Red Team attempts to penetrate systems. The Blue Team defends and detects. That in itself is valuable, but what sets Purple Teaming apart is what happens next.
Afterward, both teams reviewed the session together. Where did the Red Team gain access quickly? Which attack techniques were detected, and which were not? Where did the hardening hold up? That open discussion afterward provides insights you wouldn’t get in a typical penetration test.
Aaron van Diepen put it well: “The importance of collaboration becomes clear when you see how much more you can achieve by discussing situations together right away.”
What are the benefits?
For the Red Team, it was valuable to see which attacks were detected relatively easily and where the detection systems were less effective. That information will help refine attack techniques in future sessions.
For the Blue Team, it was actually interesting to see where the Red Team was able to gain quick access and where the security measures in place were effective. Not as a way to settle scores, but as a learning opportunity.
The atmosphere was relaxed and friendly, but definitely competitive. With pizza on the side. Just the way it should be.
Why SUPERP is going to do this more often
This was the first edition. It certainly won’t be the last. SUPERP plans to further expand its Purple Teaming sessions in collaboration with OffSec, and eventually offer them to clients and partners who want to strengthen their digital resilience.
The essence of what we’ve learned:
- Collaboration between attackers and defenders provides more insight than either side acting alone.
- The real value lies in being open with each other afterward about our respective approaches and findings.
- Purple Teaming isn't a one-time exercise, but a format that you repeat and refine.
