Purple teaming vs red teaming: which to run first

Run purple teaming when you need to confirm, technique by technique, that your logging and detections fire. Run red teaming when you need to know whether defenders notice a covert attacker at all. The two answer different questions, so the choice depends on which question your board, regulator or security team is asking today. A purple exercise is collaborative: attackers and defenders agree on a set of techniques, execute them in sequence, and review together which actions were logged, alerted on and investigated. Its output is a list of gaps with specific log sources, rules and response steps to fix. A covert red team runs without the defenders' knowledge, aims at an objective and measures detection and response as an outcome. Its output is a narrative of what the attackers reached and whether anyone reacted, which is valuable but gives less guidance on which individual rule failed.

The usual order is purple first, then covert red team. Purple teaming closes known gaps in logging and detection so that a later covert test measures a program that has already been tuned, rather than one that will fail on basic telemetry. A covert red team then tests the improved program end to end, including the human and process layers that a technique-by-technique exercise does not reach. If your program has never run an exercise of either kind, a purple exercise on a small set of high-risk techniques is usually the lower-risk starting point, because the defenders know what is being tested. The trade-off is that a purple exercise can make detection look better than a surprise attack would find it. Confirm with your provider how the technique list was chosen and whether any step is run without warning.

If you operate under TIBER-EU, the order is set for you. The framework requires a purple teaming exercise after the red team test: the replay follows within 10 weeks of the end of active testing, and the topics are chosen jointly by the control, red and blue teams. Under TIBER-EU, a blue team test report also lists, for each attack step, the detected actions and matching log entries, which feeds the purple discussion directly. Before you commit budget, ask any provider to show how a purple exercise would record the log sources and detection rules it tested, and how a covert red team would report what the defenders did not see. Confirm with your supervisor or competent authority which exercise types they accept for your scope.

How purple and red teaming differ on goals, scope and method

This table compares purple and covert red team exercises across goal, defender awareness, scope, method, rules of engagement, participants, outcome framing and duration inputs. Read each row as a question to ask your provider: the right choice depends on whether you need to confirm detection coverage for known techniques or test whether defenders notice a covert adversary at all.

Dimension	Purple teaming	Covert red team exercise
Primary goal	Confirm that logging and detection work for specific techniques, and fix the gaps found	Test whether the organization can detect and respond to a determined adversary pursuing an objective
Defender awareness	Blue team is aware and works alongside testers, technique by technique	Blue team is unaware during active testing, so detections and responses are observed without warning
Scope	Techniques, log sources and detection rules chosen jointly, including gaps that could not be tested earlier	Objectives and target systems set by the control team, with the attack path left to the red team
Method at buyer level	Structured walkthroughs, replay of attack steps and tuning of detections, often guided by a technique list such as MITRE ATT&CK	Multi-step covert operation using techniques chosen by testers, possibly including social engineering, run to reach a set objective
Rules of engagement	Agreed with the blue team and defined as a collaborative schedule, with clear rules for sharing attack details	Written authorization limiting targets, timing, safety limits and escalation paths, with a control team that can stop or continue the test covertly
Who participates	Red, blue and control teams together, with the blue team leading detection analysis	Red team and a small control group; most of the security operations staff do not know the test is running
Pass or fail framing	No pass or fail; findings are gaps and changes to detection, logged against specific techniques	TIBER-EU states that tests produce no pass or fail result, so the output is a narrative of what was detected and how
Duration inputs	TIBER-EU places purple teaming within 10 weeks of the end of active testing; confirm session count and scope with the provider	TIBER-EU requires at least 12 weeks of active testing for its threat-led tests; confirm the duration for your own scope
Evidence of value	Log entries and detection rules that map to each attack step, as in the TIBER-EU blue team report	Narrative of attacker actions, the detection timeline and the blue team's response, with a joint review afterward

How each approach runs in practice

Purple teaming is a collaborative exercise. The control team, the red team and the blue team choose topics together and work through them technique by technique, so the defenders know what is being tested and can watch the attack logs appear. In TIBER-EU, a purple teaming exercise follows the replay within 10 weeks of the end of active testing, and the topics can range from table-top discussions to technical walkthroughs.

Topic selection: The joint team picks topics from items that could not be tested during active testing, identified vulnerabilities, alternative scenarios, proofs of concept, planned remediation and business continuity exercises.
Format flexibility: A session can be a discussion of how an attack would be handled or a hands-on walkthrough of a specific technique against a specific control.
Log evidence: The blue team test report lists, for each attack step, the detected actions and the matching log entries, which gives the joint session a concrete starting point.
Shared outcome: Defenders see the attacker's path and their own telemetry side by side, so gaps in logging or alert rules are visible and can be assigned.
Remediation tracking: Agreed fixes and re-checks are recorded against the same techniques.

Before you run this, confirm with your provider who holds the attack records, how sessions are minuted, and how the agreed topics will be retested once fixes are in place.

What purple teaming finds and misses, and what red teaming finds and misses

Purple and red teaming answer different questions, so each one leaves gaps the other can fill. The cards below set out what each approach surfaces, what it cannot show, and what to check in the exercise plan before you commit budget.

Purple teaming finds logging gaps

A purple exercise walks the team through each technique and checks whether the expected log entries exist, reach the SIEM and carry enough fields to alert on. Missing log sources are the most common finding because nobody notices them until a technique is replayed. Ask for a per-technique table showing which events were produced, which were ingested and which were absent, so the remediation backlog maps to specific sources.

Purple teaming finds fragile alert logic

Some techniques are logged but never raise an alert, or alert only when the attacker uses a default tool. Replaying the same technique with small variations shows whether detection rules depend on a single string, path or binary name. A rule that fires only on the tester's exact tool is a finding, not a pass. Check whether the exercise tests variants of each technique and whether rules are updated afterwards.

Purple teaming misses defender reaction

Because the exercise is collaborative and planned, defenders know what is coming and the technique order is agreed in advance. It therefore does not test whether analysts triage a noisy queue, escalate correctly at 2 a.m. or act on an ambiguous signal. Pair purple results with a covert test or a live tabletop if the question is decision making under uncertainty, and confirm the provider plans for that gap.

Red teaming finds undetected attack paths

A covert red team chains access, privilege escalation and lateral movement toward an agreed objective without telling defenders. Its strength is showing whether an attack path succeeds end to end and whether anyone notices. The result is a path, not a list of techniques, so the report should show where the attacker was stopped, where they were detected and where nothing happened.

Red teaming may skip techniques

A red team works toward an objective within a fixed window, so it will not exercise every technique in a framework such as ATT&CK. Techniques it does not attempt give no evidence either way. CIS Safeguard 18.4 asks that security measures be validated after each test so detections cover the techniques testers used, which means a red team alone leaves untested techniques. Ask the provider which techniques were out of scope and whether a purple exercise will cover them.

How TIBER-EU requires purple teaming after a red team test

In TIBER-EU, purple teaming is not optional and it is not the same exercise as the red team test itself. The sequence runs in three stages: active testing of at least 12 weeks, a replay in which the red team and blue team walk through the attack steps, and then a purple teaming exercise within 10 weeks of the end of active testing. Control, red and blue teams choose the topics for that purple teaming session jointly. The topics can range from table-top discussions to technical walkthroughs, and they can cover issues the red team could not test during active testing, vulnerabilities already identified, alternative attack scenarios and their consequences, proofs of concept, planned remediation and business continuity exercises. The ECB states that these tests produce no pass or fail result, so the purple teaming session is where the organization turns findings into agreed actions rather than a score.

The blue team test report is the main input to that session. For each attack step, it lists the detected attack actions and the corresponding log entries, and it identifies the topics that should move into purple teaming. Read this report against your own logging pipeline before the session: check whether the log entries the report cites actually reach your SIEM, whether the alerts that should have fired did so, and which steps left no trace. Those gaps are usually the most useful topics to bring to the joint session. If the red team was detected during active testing, confirm how the control team handled covert continuation and whether any limited purple teaming exercise was used, because that case can count toward the 12 weeks of active testing.

Before you sign a TIBER-EU engagement, confirm the exact phase lengths, the replay format, the purple teaming deadline, and who on your side owns each topic with the control team and the test provider. Those specifics are set in the framework document and in any national implementation, so check them against the TIBER-EU Framework (January 2025) and with your competent authority before planning budgets or staff time.

What you receive from each approach

This table compares the artifacts each exercise format hands back to your organization. Use it to check whether a purple team or a red team will give you the evidence your board, regulator or assessor expects, since the exact report format depends on your provider's contract and the framework you adopt.

Deliverable	Purple teaming	Red teaming
Primary output	Technique-by-technique record of what was tested and what defenders saw	Attack narrative showing how the team reached the agreed objective
Detection evidence	Coverage notes per technique, with the log entries that did or did not fire	Blue team's detected actions and matching log entries, where the TIBER-EU report format applies
Tuning guidance	Specific detection and logging tuning recommendations for the techniques tested	Findings framed around attack paths and objective outcomes, with tuning left to follow-on work
Remediation list	Topic list of gaps to fix, agreed jointly by control, red and blue teams	Prioritized findings and attack paths, usually delivered as a written report
Joint review	Built into the exercise as the core activity	Held after active testing, where the blue team's detections are compared with the red team's actions
Pass or fail result	Not a scored outcome; it measures coverage and gaps	No pass or fail result under TIBER-EU; other contracts may score objectives differently
Format control	Usually set by the exercise plan and the framework, such as the TIBER-EU purple teaming topics	Set by the provider's contract and the framework used, so confirm report sections before signing

Questions buyers ask before commissioning either approach

How much does purple teaming cost and what drives the price?

No supplied fact gives a price for purple teaming, so ask providers for a written quote rather than comparing day rates. Cost comes mainly from the people paid for: the provider's testers and facilitators, your blue team's time, and any tooling or lab access. The main cost drivers are the number of techniques in scope, how many environments are covered, how many defenders take part, and whether the provider holds independent accreditation. Purple teaming is often a bounded exercise, so most of the spend is one-time for the engagement, while detection content and rule tuning you keep afterward are the lasting output. Ask each bidder to itemize testing, workshop, reporting and retest effort separately so the quotes are comparable.

How long does a red team engagement take?

The duration depends on the objective, the attack surface and how much of the work is covert. Under TIBER-EU, the framework requires at least 12 weeks of active testing for a test that follows its phases, a figure the ECB published in its January 2025 framework, but that regulated format is not the default for every organization. A commercial red team that is not regulator-led is scoped in writing, so confirm the active testing window, preparation period and reporting time with each provider before work starts. A purple teaming exercise is usually scheduled after a red team's active testing and is measured in workshops rather than covert weeks, so confirm its length with the provider as well.

What does the work need from our staff?

Both approaches need named staff from security operations, incident response and the system owners of the in-scope environments. A covert red team needs a small, tightly controlled set of people who know the engagement exists, because the goal is to see whether defenders notice. A purple team needs the people who run detections day to day, with access to SIEM content, logs and change records. Ask the provider which roles they expect, how many hours each role will give across the engagement, and who approves scope changes. The blue team test report format used by TIBER-EU lists detected attack actions and matching log entries, which shows the kind of records your team should be ready to produce.

Can our own team run purple teaming without an external provider?

Yes, a mature internal team can run purple teaming, provided it has offensive skill to run the techniques, detection engineers who can write and tune rules, and a clear list of techniques to test. Internal teams often start from the MITRE ATT&CK Enterprise matrix, which lists 15 tactics in ATT&CK v20. The gap is usually independent judgment: an internal team may not notice its own blind spots, and it may lack the authority to test production systems. A provider adds an outside view and experience, and it is worth checking whether a provider holds CREST accreditation or individual certification, since CREST accredits member companies and certifies individuals in security testing and red teaming disciplines.

Which compliance frameworks require red teaming or purple teaming?

Requirements depend on which regime applies to you. TIBER-EU, in its January 2025 framework, requires mandatory purple teaming as part of a threat-led red team test. DORA Article 26 requires threat-led penetration testing at least every 3 years for entities their competent authority designates, and Article 25 lists broader testing types. NIST SP 800-53 Rev. 5 control CA-8 covers penetration testing and includes enhancements for red team exercises, and SP 800-53B selects CA-8 in the high baseline. CIS Safeguard 18.4 asks that security measures be validated after each test so detections cover the techniques used. Confirm with your regulator or assessor which of these applies to you, because a framework's requirements rarely mention purple teaming by name.

What changes for a first engagement?

A first engagement should start with rules of engagement, scope and a named point of contact, because those decisions drive everything else. NIST SP 800-115 provides a rules of engagement template in Appendix B that you can adapt. For a purple team, begin with a shortlist of techniques tied to your most important systems and confirm that logging is turned on before the workshops. For a covert red team, agree on the legal authorization, the escalation path if the testers are caught, and how the exercise will be stopped. The first engagement usually produces the most learning about your logging gaps, so plan remediation capacity for the findings before the work begins.

Choosing the order: a sequence for most programs

This sequence builds trust in detection step by step, so that a covert red team result reflects a tuned defense rather than a known gap. It is a planning pattern for most programs, not a requirement outside TIBER-EU.

Confirm baseline logging and coverage
Start by checking which log sources feed your monitoring tools and whether they capture the events you would need to see an intrusion. Your security engineering team and the owners of the monitored systems do this work, often with an external assessor reviewing the results. CIS Safeguard 18.4 asks that security measures be validated after each test so detections cover the techniques testers used, so this baseline is the reference point for every later step. The step is done when you have a written list of gaps in logging for your priority systems, each with an owner.
Map validation scope to known techniques
Select a set of adversary techniques relevant to your sector and systems, and map each one to MITRE ATT&CK Enterprise tactics and techniques. The buyer's question here is which attacker behaviors you expect to detect today, and this list makes that question testable. Decide with your threat intelligence and testing providers which techniques are in scope and which systems they touch. The step closes when the technique list is agreed in writing with the owners of the detection tooling.
Run purple exercises on known techniques
Run collaborative sessions where the testers execute each agreed technique while defenders watch the alerts and logs in real time. Both sides record, for each technique, whether it was logged, whether an alert fired, and whether the analyst responded. Gaps lead to tuning rules, adding log sources or changing alert logic, then retesting the same technique. The step is complete when each technique has a recorded result and each gap has a fix or an accepted-risk decision.
Schedule the covert red team after tuning
Once detections are tuned, define an objective-driven covert operation with a written rules of engagement and a small group who know it is happening. The buyer's question shifts from whether a technique is detected to whether the defenders notice a sustained intrusion at all. Ask the provider to confirm how it will handle detection, escalation and stop conditions, and who in your organization holds the authorization. The step closes when the engagement letter and rules of engagement are signed.
Review what the covert team exposed
After the operation, the provider should produce a report that shows the attack path, the actions that were detected, and the log entries that supported each detection. Compare this against the baseline and tuning records from the earlier steps to separate gaps that were known from gaps that are new. Your team should agree on the findings in a joint review rather than treating the outcome as a win or loss for either side. The step is done when every finding is classified as new, known or accepted.
Rerun purple sessions on exposed paths
Take the attack steps the covert team used that went undetected or were detected too late, and run purple sessions on those specific paths. TIBER-EU uses a similar pattern, where purple teaming topics include issues that could not be tested during active testing and identified vulnerabilities. Confirm that each fix works by replaying the path, and update the technique list and baseline records. The step is complete when each exposed path has been retested with a documented result.
Confirm the cycle and set the next review
Record the results in one place so that the baseline, technique coverage, tuning changes and covert findings can be reviewed together by leadership and auditors. Decide with your provider and internal owners how often the cycle should run, since no duration is set by this sequence. Check that any regulatory obligation you hold, such as a TIBER-EU or DORA requirement, is met by the chosen format before relying on this plan. The step is done when the next review date and owners are recorded.

When compliance frameworks call for each approach

If you operate under TIBER-EU, the question is no longer which exercise to run but whether you can run both. The framework requires threat intelligence-based red team tests with mandatory purple teaming, and the purple teaming phase follows the replay within 10 weeks of the end of active testing. Topics are chosen jointly by the control, red and blue teams and can include vulnerabilities the red team identified, scenarios that could not be tested, and planned remediation. Plan the purple teaming window and staffing when you scope the red team, not after the report arrives, because the blue team test report already flags the attack steps and log entries that should anchor those sessions.

DORA works differently. Article 26 requires threat-led penetration testing at least every 3 years, but only for entities that their competent authority has identified for it. Article 25(1) lists the wider test types an in-scope entity must run, including scenario-based tests and penetration testing. If you are not sure whether your authority has designated you, ask it directly and get the answer in writing before you commit budget. A voluntary red team does not automatically satisfy a TLPT obligation, so confirm which test your regulator will accept and what evidence it expects.

Outside financial regulation, the controls are more general. CIS Safeguard 18.4 asks that security measures be validated after each penetration test so that detections cover the techniques the testers used, which is a direct argument for purple-style confirmation of logging and alerting after any covert exercise. NIST SP 800-53 control CA-8 covers penetration testing, with enhancements that describe independent testers and red team exercises. Baseline selection matters: in SP 800-53B Release 5.2.0, CA-8 and CA-8(1) are selected only in the high baseline, so a moderate-impact system may not be obligated to run red team exercises at all. Confirm your baseline and any agency or customer requirements with your assessor before you decide.

Cost drivers for purple and red teaming

Purple and red teaming cost less in tester hours than in the internal time they consume and the tooling they require. The cards below set out who pays for each component, what recurs from one exercise to the next, and what to ask for in a written quote.

Scope and technique count

Cost scales with how many techniques are tested and how deep each chain runs. A covert red team that pursues one objective through several paths costs differently from a purple exercise that walks through a fixed list of ATT&CK techniques. The provider bills for tester days, so ask the quote to list the techniques, target systems and objectives by name. Ask whether the scope is fixed or capped by days.

Defender time

Purple teaming is collaborative, so the blue team's hours are a real cost even though an external provider does not bill for them. Replay sessions, detection tuning and follow-up reviews all draw on SOC analysts and engineers who would otherwise handle live alerts. Recurring exercises need named staff with time reserved in their plans. Confirm who attends each session and how many hours are reserved for remediation.

Environment and tooling

A purple exercise needs a way to replay techniques, capture log output and compare it with what the SIEM and endpoint tools recorded. Some teams build this from open-source emulation tools, others license commercial platforms. Ask whether the provider brings its own tooling, whether a test environment or production-like copy is required, and who maintains it between exercises.

Threat intelligence input

Threat-led exercises pay for intelligence work before any testing starts, usually as analyst time that selects actors and scenarios relevant to your sector. Generic technique lists cost less but test less specific behavior. Under TIBER-EU, intelligence is gathered as part of the test itself. Ask whether threat intelligence is included in the quote or billed as a separate phase, and how often it refreshes.

Provider accreditation

Accredited providers typically charge more because accreditation requires maintained staff certifications and audited processes. CREST accredits companies and certifies individuals in security testing, red teaming and threat intelligence, and the Bank of England names it as the accreditation and certification body for CBEST. Where a regulator requires accredited testers, the premium is a fixed requirement rather than an option. Ask for the named individuals' certifications and their current status.

Reporting depth and retests

Reporting cost depends on how much evidence the provider must produce: per-step log correlation, detection gap analysis, and a purple teaming debrief all add time. Retests of fixed detections are often a separate line item that recurs each cycle. Ask the quote to separate the initial report, the joint review, and any retest, and to state the format of the deliverables.

How DeployOpen scopes, delivers and supports security testing

DeployOpen is a Chainscore Labs company that plans, runs and documents security testing inside the client's own infrastructure, including cloud accounts, data centers and air-gapped networks. For purple teaming and red teaming, we agree the scope, deliverables and timeline in writing before work starts, so the exercise type matches the question the board or regulator is asking.

How we scope

Written scope states whether the exercise is covert red teaming, collaborative purple teaming, or both in sequence.
Scope defines the objective, target systems, rules of engagement and who on the client side knows about the test.
Engagements are fixed-scope, so deliverables and timelines are agreed in writing before any testing begins.
Ask us to confirm which controls are in and out of bounds, and who approves any change to scope.

How we build

We prepare the test environment, accounts and access paths the scope requires, documented before active testing starts.
For purple teaming, we agree the technique list and logging sources with the blue team ahead of each session.
Testers record the techniques used and the timestamps needed to match each step against the client's logs.
Where a client holds a regulatory framework, we check the planned phases against that framework's own requirements.

How we hand over

Deliverables include a report mapping each technique to the detection, log entry or gap found.
Purple teaming outputs a joint list of detection tuning and remediation items with named owners.
Covert red team outputs record which attack steps the defenders noticed and which went unseen.
We hand over documentation the client can keep, so the exercise can be repeated by their own staff.

How we support

Ongoing support, upgrades and continuous testing are available as retainers, separate from the fixed-scope exercise.
A retainer can schedule repeat purple teaming after detection changes, so new rules are checked against the same techniques.
We do not issue audit reports, attestations or certifications. Independent auditors and certification bodies do that work.
Ask us to confirm retainer scope, response expectations and reporting cadence in the written proposal.

Purple teaming vs red teaming