Overview
Many Indian organisations outsource monitoring to an MSSP and rarely see how its rules behave against a live technique. A purple team exercise changes that. Our testers run agreed MITRE ATT&CK techniques while your in-house or outsourced SOC watches, and both sides record what was logged, what alerted and what slipped through. It is also a practical way to check that CERT-In's six-hour reporting clock could start on time.
A purple team exercise is built for improvement rather than surprise. Instead of testing your defenders without their knowledge, our testers and your detection team work in the same room, or the same call, executing attacker techniques openly and watching together whether each one is logged, alerted on or missed. The point is not to win but to measure, and then to fix what the measurement reveals while everyone is still at the table.
We work through a set of techniques drawn from MITRE ATT&CK and chosen to match the threats that matter to you. For each one we run it, check what your tooling captured, and where a detection is missing or weak, your team adjusts the rule or log source on the spot and we run the technique again to confirm it now fires. That immediate loop, execute, observe, tune, re-test, is what makes the exercise so productive compared with a report you action weeks later.
The result is measurable coverage, not just a list of gaps. You finish with a clear picture of which ATT&CK techniques you detect, which you now detect because you tuned them during the exercise, and which need further work, along with the improved rules themselves. It is the fastest way to raise detection maturity and a natural next step after a red team assessment exposes where your visibility falls short.
How we work with Indian clients
- Fixed-price proposals in INR, with 18% GST shown separately on every invoice
- Remote-first delivery from Ahmedabad in IST working hours; on-site work can be discussed at scoping
- Signed authorisation, an NDA on request and agreed testing windows before any activity begins
- Reports and closure evidence shaped for RBI, SEBI CSCRF, IRDAI, DPDP, ISO 27001 and PCI DSS reviews
What's included
Our approach
- PlanningWe agree techniques, tooling, participants and success measures with your team.
- ExecutionTesters run each technique openly while defenders watch their tooling.
- MeasurementWe record what was detected, what was missed and why.
- Tuning & re-testDetections are improved on the spot and the technique is re-run to confirm.
- Report & coverageWe deliver before-and-after coverage and the improved detections.
What you receive
- Before-and-after detection coverage by ATT&CK technique
- Improved detection rules created during the exercise
- Record of techniques detected, missed and tuned
- Prioritised list of remaining detection gaps
- Knowledge transfer to your detection team
Standards & frameworks
- MITRE ATT&CK
- PTES
- NIST SP 800-115
- CVSS v4.0
- CERT-In Audit Guidelines 2025
Frequently asked questions
What is the difference from a red team?
A red team is covert and measures whether you detect an unannounced attacker. A purple team is collaborative and open, built to improve detection technique by technique while your defenders watch and tune. One grades you; the other coaches you, and they work well in sequence.
What do our defenders need to bring?
Access to the detection tooling they run day to day, the people who manage it, and permission to change rules during the session. The more your team can adjust log sources and detections live, the more coverage you leave the exercise with.
Do we need a mature SOC first?
Not a mature one, but you do need some detection capability to tune, whether in-house or managed. If you have logging and alerting you want to improve, a purple team pays off quickly; if you have almost no visibility yet, we will suggest building that first.
When do red team and phishing activities run?
During Indian business hours (IST) by default. Any evening, weekend or holiday activity is agreed in writing first, and your named escalation contact can pause the exercise at any point.
Can a red team exercise count towards a CERT-In audit?
Red teaming is listed as an audit type in CERT-In's 2025 guidelines, but those audits are meant to be done by empanelled auditors, and we do not claim empanelment. Tell us at scoping what the exercise is for and we will say clearly whether our work can serve that purpose.