Explain like I'm five · Security

What is a Purple Team?

Purple teaming, told as a story about the hired thief and the guard sitting down at the same table.

red teamsneaks in, quietlyblue teamwaits for the bellneither knows what the other is doing — there's a wall between them

The red team sneaks in; the blue team waits for the bell.The thief we hired and the guard room. There's a wall between them, and neither knows what the other is doing.

REPORTweeks later, a thick reportreadhang bellsNEXT YEAR?check againa real thiefmeanwhile the bell stays silent

Done separately, it's slow.Weeks later a thick report arrives. Read it, fix things, check again next year. Meanwhile the bell stays silent.

RED + BLUE = PURPLEgoing in through the west window now…the bell didn't ringquietnew bell① say it first② watch the screen③ hang a bell right there④ try againone habit at a time, in the same room

A purple team is the thief and the guard at one table.The thief says what they'll do, then does it. The guard checks whether the bell rang. If not, they hang a new bell right there and try again.

Say it firstout loud, not sneaky
Watch the screendid the bell ring?
Hang a bell nowno waiting till next year
Try againdoes it ring this time?
THE THIEF'S HABITSbell?to dosend a fake letterclimb the west windowhang bellcopy a keymove the storeroom chestshang bellerase the diarygreen rang, red stayed silentone by one, red lines turn green

Go through the thief's habits, one line at a time.Pick habits one by one from the thief encyclopedia. Green means the bell rang; red means it didn't. One by one, red lines turn green.

west windowit rang!the bell they hung togetherthe real thief hears the bell from the very first step

When the next real thief comes, the bell rings.It's the bell they hung together. When the thief and the guard are one team, the real thief hears the bell from the very first step.

In one breath

Purple team = the hired thief (red) and the guard room (blue) at one table: try one habit → check the bell → hang a new bell right there.

Instead of red and blue working apart, they sit together, run one attack technique at a time, check detection immediately, and strengthen the rules on the spot.

When grown-ups say it

Red team
The hired thief. The side that breaks in like a real thief would. → the thief we hired
Blue team
The guard room. The side that watches the bell and catches thieves. → the guard room
Purple team
Both at one table. Not a third team — a way of sitting together. Red + blue = purple.
Adversary emulation
Copying a thief's habits. Doing exactly what a real thief does, in order. → a thief's habits
ATT&CK
The habits list. The encyclopedia you pick lines from. → the thief encyclopedia
Detection gap
A red line. A habit the thief did with no bell. What purple teaming finds.
Detection rule
A new bell. What turns a red line green. → the guard room screen
Purple team exercise
The day they sit together. Usually a day or a few, working through one habits list. → the guard who doesn't wait for the bell
Next story
The Team That Plays the Real Thief →
Want another term as a picture book? Request →