Increasing Security ROI with Adversary Simulation and Purple Teaming
summary
Panelists argue that adversary emulation mimics documented threat actors while simulation/red teaming mixes novel TTPs, and purple teaming is the collaborative loop that tunes controls. They demo free tools like Atomic Red Team and an Adversary Village sandbox, publish a purple team exercise framework v3, and recommend weekly or sprinted tests to drive measurable gains: reduced gaps, tuned EDRs, and improved mean time to detection and response. Start small with micro emulation and build a procedure library tied to MITRE ATT&CK.
AI-written summary · about
chapters (4)
- 0:00Start
- 3:38Adversary Emulation vs. Simulation
- 8:01What is a Purple Team?
- 9:32Threat-Informed Defense
related talks
43mShades of Purple: Getting Started and Making Purple Teaming Possible
40mAdversary Simulation: Close the Gaps in Your Security Posture
52mBuilding the Always-On Purple Team
53mAtomic Red Team: Where Adversary Emulation and EDR Testing Meet
39mColorful AppSec - Red, Blue, or Purple?
50mAdversary Emulation: How I Stopped Being Polite and Got Real Results
01mThank you, Chris Peacock, for telling us about his Purple Team 101 training session
49mTraining for Incident Response: The Red, the Blue, and the Ugly