-
The Joins Nobody Owns: How Identity, Asset, and Rotation Registries Get Wired Together
The last essay in the identity series ended with a promise: the next thread would cover the joins. This is that essay — why the join between your identity provider and your asset inventory is a maintained artefact with an owner, what happens to an exercise when the join is stale, and why the join work is where a quarterly cadence quietly dies.
-
Quarterly Cadence: How Identity Purple Teaming Survives a Year in a Regulated Environment
The first three essays in this thread built the framework. The fourth is the one the framework was for: what happens when the same exercise runs four quarters in a row in the same environment, against the same boundary, with the previous gap list as its scope. This is a longitudinal essay — one anonymised regulated environment, four quarterly runs, the deltas in the gap list, the CDE model, the response time, and the evidence pack. It closes the identity series with the thing the previous essays deferred: a cadence that survives a year.
Purple Teaming PCI Detection Engineering Programme Operations
-
Purple Teaming a PCI Environment: What a Generic Identity Exercise Misses
A generic identity-focused purple team exercise will tell you whether you can detect a credential-driven intrusion. A PCI environment is a different problem. The Cardholder Data Environment is segmented, the QSA is watching, the assessor sign-off is at stake, and the parts of the framework that hold in a flat enterprise are the parts that break first behind a PCI scope. This is the essay on what changes when the perimeter is a regulated one, and why a generic exercise is the wrong shape of test
-
Containing a Credential-Driven Intrusion: What Good Looks Like in the First Hour
Detection is half the problem. The other half is what happens in the first hour after the SOC believes the credential is real — the joins, the actions, the order, and the things the playbook never rehearsed. This is the response side of identity-focused purple teaming
-
Purple Teaming Identity Systems: A Practitioner's Guide
Identity is the perimeter most attackers now attack first. This is the guide to a purple team exercise that actually tests it: where to look, what to emulate, what to detect, what to measure, and what to do when the exercise finds a real one