PurpleTeamAIThe practitioner's guide to purple teaming2026-09-17T00:00:00Zhttps://purpleteam.ai/Hugh McGauranhello@purpleteam.aiICS Tabletop Exercises: Why the Lessons Never Transfer to the Plant Floor2026-09-17T00:00:00Zhttps://purpleteam.ai/essays/ics-tabletop-exercises-lessons-dont-transfer/An IT tabletop finds a process gap and the team rewrites the runbook. An ICS tabletop finds the same gap and the team can do nothing with it, because the person who would have to act on the gap is two floors down, on a different shift, under a different chain of command.What a Good ICS Detection Looks Like in Practice2026-09-06T00:00:00Zhttps://purpleteam.ai/essays/what-a-good-ics-detection-looks-like-in-practice/There is a lot of advice about ICS detection that talks about MODBUS, DNP3, and the protocol layers. This is the part that comes after the protocol talk: what a good detection actually looks like in the SIEM, and what the SOC analyst does with itHow to Threat-Model a System You Have Never Seen Before2026-09-03T00:00:00Zhttps://purpleteam.ai/essays/how-to-threat-model-a-system-you-have-never-seen-before/Most threat-modelling advice assumes you have weeks, a working relationship with the engineering team, and a system that is stable. None of those apply when you are walking into a new environment on a Tuesday afternoon. Here is the version that doesHow to Build an Insider-Risk Programme That Actually Catches the Bad Cases2026-08-27T00:00:00Zhttps://purpleteam.ai/essays/how-to-build-an-insider-risk-programme-that-actually-catches-the-bad-cases/Most insider-risk programmes are aimed at the wrong target. The detection engineering is theatre. The behavioural analytics are noise. The case management is a black hole. Here is how to build a programme that finds the cases that actually matterThe Detection Rule That Changed How I Think About Fidelity2026-08-20T00:00:00Zhttps://purpleteam.ai/essays/the-detection-rule-that-changed-how-i-think-about-fidelity/There is one detection rule in my career that genuinely changed how I think about detection fidelity. It was not a clever rule. It was a simple rule. The simplicity is what taught me the most. Here is the rule and what it taught meWhat a CISO Actually Does on a Tuesday Afternoon2026-08-13T00:00:00Zhttps://purpleteam.ai/essays/what-a-ciso-actually-does-on-a-tuesday-afternoon/The CISO job description reads like a strategy role. The actual job is mostly operational. Here is what a competent CISO does on a typical Tuesday afternoon, and what the things look like in practiceHow to Hire a Detection Engineer When You Have Never Hired One Before2026-08-06T00:00:00Zhttps://purpleteam.ai/essays/how-to-hire-a-detection-engineer-when-you-have-never-hired-one-before/Most detection engineer hiring fails because the job description is wrong. Here is what to actually look for, what to test in the interview, and the most common mistakes programmes make on the first hireHow to Run a Purple Team Exercise When Nobody Has Done One Before2026-07-30T00:00:00Zhttps://purpleteam.ai/essays/how-to-run-a-purple-team-exercise-when-nobody-has-done-one-before/Most purple team advice is written for teams that have done several. Here is the version for the team that is about to do their first one, in order, with the parts that most programmes get wrongTabletop Exercises That Actually Prepare You for an Incident2026-07-23T00:00:00Zhttps://purpleteam.ai/essays/tabletop-exercises-that-actually-prepare-you-for-an-incident/Most tabletops are theatre. A senior person reads a scenario, the room talks through what they would do, nobody changes anything, and the postmortem is a one-pager that says 'we are well prepared.' Here is how to run one that is not theatreThe Six-Month Build: What a Real Detection Engineering Programme Looks Like2026-07-16T00:00:00Zhttps://purpleteam.ai/essays/the-six-month-build-what-a-real-detection-engineering-programme-looks-like/Most 'detection engineering programmes' are not programmes. They are a person with a Sigma rule and a prayer. Here is what a real six-month build looks like, in order, and what each phase actually costsWhy Most Threat Intelligence Programmes Are Not Worth the Money2026-07-09T00:00:00Zhttps://purpleteam.ai/essays/why-most-threat-intelligence-programmes-are-not-worth-the-money/Threat intelligence is one of the most expensive parts of a security programme and one of the most under-used. Most programmes pay for feeds they do not read, run platforms they do not use, and produce reports that do not change anything. Here is the honest version of the workThe Red Team Engagement That Changed How I Think About Risk2026-07-02T00:00:00Zhttps://purpleteam.ai/essays/the-red-team-engagement-that-changed-how-i-think-about-risk/There is one engagement in my career that genuinely changed how I think about cybersecurity risk. It was not the most sophisticated operation I have run. It was not the most expensive. It was the one that taught me the most. Here is what it was and what it taught meWhat I Look For in a Red Team Report2026-06-25T00:00:00Zhttps://purpleteam.ai/essays/what-i-look-for-in-a-red-team-report/Most red team reports are unreadable. The good ones are gold. Here is what makes the difference, in order, with the parts that most red teamers get wrongWhat a Good Detection Engineer Actually Does All Day2026-06-18T00:00:00Zhttps://purpleteam.ai/essays/what-a-good-detection-engineer-actually-does-all-day/The job description for a detection engineer reads like a software engineer with a security focus. The actual job is more like an editor at a small newspaper. Here is what the work looks like when the title is right and the work is also rightBuilding a Detection Baseline: The Work Nobody Wants to Do2026-06-11T00:00:00Zhttps://purpleteam.ai/essays/building-a-detection-baseline/Every detection engineer has been told to build a baseline. Almost nobody has been given a clear answer about what a baseline actually is, what data it needs, or how it connects to the rules the SOC actually runs. Here is the honest version of the workPurple Teaming at Scale: How It Changes When You Have 20 Blue Team Analysts2026-06-04T00:00:00Zhttps://purpleteam.ai/essays/purple-teaming-at-scale/Most purple team advice is written for a team of three. If you scale to twenty, the bottlenecks move, the failure modes change, and the programme either matures or quietly dies on contact with reality. Here is what shifts, and what does notAdversary Emulation vs Penetration Testing: Why the Distinction Matters2026-05-28T00:00:00Zhttps://purpleteam.ai/essays/adversary-emulation-vs-penetration-testing/You paid €80,000 for a "red team engagement." The report arrived with 47 findings, a 12-page executive summary, and a heat map of your network that looked like something out of a disaster movieHow to Write a Purple Team Report That Actually Gets Read2026-05-21T00:00:00Zhttps://purpleteam.ai/essays/purple-team-report-that-gets-read/You ran a three-week purple team exercise. Your team worked hard. The red team executed a realistic adversary emulation. Your blue team detected some of it, missed most of it, and the gaps are clear. The debrief went…Living Off the Land: Why the Best Attackers Don't Look Like Attackers2026-05-14T00:00:00Zhttps://purpleteam.ai/essays/living-off-the-land/Volt Typhoon maintained access to critical infrastructure networks in the United States for at least five years. Microsoft, Mandiant, and the Five Eyes governments published the technical details in 2024. The…The Insider Threat Problem Is Not What You Think2026-05-07T00:00:00Zhttps://purpleteam.ai/essays/insider-threat-problem/Your insider threat programme is aimed at the wrong targetThe 7 Most Pointless Findings in OT Pen Tests2026-04-30T00:00:00Zhttps://purpleteam.ai/essays/seven-pointless-ot-pen-test-findings/If you run enough OT pen tests, you start to notice a pattern. The report arrives, the client is confused, and the findings have a peculiar quality: technically correct, operationally impossible to remediate, and…Purple Teaming OT: Why "We Can't Test That" Is No Longer Acceptable2026-04-23T00:00:00Zhttps://purpleteam.ai/essays/purple-teaming-ot/I keep hearing the same thing in conversations about operational technology securityHow to Scope a Red Team Engagement That Tells You Something Real2026-04-16T00:00:00Zhttps://purpleteam.ai/essays/scoping-a-red-team-engagement/Most red team engagements produce an impressive document and a set of "critical findings" that the security team could have predicted before the first phishing email was sentPurple Teaming That Actually Works: A Framework for Real Collaboration2026-04-09T00:00:00Zhttps://purpleteam.ai/essays/purple-teaming-that-actually-works/You've got a red team and a blue team. They hate each otherWhy Your Red Team Tests Are Designed to Fail, And You Don't Know It2026-04-02T00:00:00Zhttps://purpleteam.ai/essays/red-team-tests-designed-to-fail/Red team comes in on Monday. They've got a scope, a timeline, and a list of techniques to test. By Friday, they've "successfully executed" initial access, lateral movement, persistence, and exfiltrationDetection Engineering in a Real Environment: Why Generic Rules Fail2026-03-26T00:00:00Zhttps://purpleteam.ai/essays/detection-engineering-real-environment/I walked into a SOC last month where they'd deployed 847 Sigma rulesYour Purple Team Test Failed Because Your Threat Model Is Wrong2026-03-19T00:00:00Zhttps://purpleteam.ai/essays/purple-team-threat-model-wrong/You ran a purple team exercise last week. Your red team executed a flawless attack chain: initial access via phishing, lateral movement via Kerberos relay, privilege escalation, and data exfiltration. Picture perfect