-
The Joins Nobody Owns: How Identity, Asset, and Rotation Registries Get Wired Together
The last essay in the identity series ended with a promise: the next thread would cover the joins. This is that essay — why the join between your identity provider and your asset inventory is a maintained artefact with an owner, what happens to an exercise when the join is stale, and why the join work is where a quarterly cadence quietly dies.
-
Quarterly Cadence: How Identity Purple Teaming Survives a Year in a Regulated Environment
The first three essays in this thread built the framework. The fourth is the one the framework was for: what happens when the same exercise runs four quarters in a row in the same environment, against the same boundary, with the previous gap list as its scope. This is a longitudinal essay — one anonymised regulated environment, four quarterly runs, the deltas in the gap list, the CDE model, the response time, and the evidence pack. It closes the identity series with the thing the previous essays deferred: a cadence that survives a year.
-
Purple Teaming a PCI Environment: What a Generic Identity Exercise Misses
A generic identity-focused purple team exercise will tell you whether you can detect a credential-driven intrusion. A PCI environment is a different problem. The Cardholder Data Environment is segmented, the QSA is watching, the assessor sign-off is at stake, and the parts of the framework that hold in a flat enterprise are the parts that break first behind a PCI scope. This is the essay on what changes when the perimeter is a regulated one, and why a generic exercise is the wrong shape of test
-
Containing a Credential-Driven Intrusion: What Good Looks Like in the First Hour
Detection is half the problem. The other half is what happens in the first hour after the SOC believes the credential is real — the joins, the actions, the order, and the things the playbook never rehearsed. This is the response side of identity-focused purple teaming
-
Purple Teaming Identity Systems: A Practitioner's Guide
Identity is the perimeter most attackers now attack first. This is the guide to a purple team exercise that actually tests it: where to look, what to emulate, what to detect, what to measure, and what to do when the exercise finds a real one
-
ICS Tabletop Exercises: Why the Lessons Never Transfer to the Plant Floor
An IT tabletop finds a process gap and the team rewrites the runbook. An ICS tabletop finds the same gap and the team can do nothing with it, because the person who would have to act on the gap is two floors down, on a different shift, under a different chain of command.
-
How to Threat-Model a System You Have Never Seen Before
Most threat-modelling advice assumes you have weeks, a working relationship with the engineering team, and a system that is stable. None of those apply when you are walking into a new environment on a Tuesday afternoon. Here is the version that does
-
What a CISO Actually Does on a Tuesday Afternoon
The CISO job description reads like a strategy role. The actual job is mostly operational. Here is what a competent CISO does on a typical Tuesday afternoon, and what the things look like in practice
-
How to Run a Purple Team Exercise When Nobody Has Done One Before
Most purple team advice is written for teams that have done several. Here is the version for the team that is about to do their first one, in order, with the parts that most programmes get wrong
-
Tabletop Exercises That Actually Prepare You for an Incident
Most tabletops are theatre. A senior person reads a scenario, the room talks through what they would do, nobody changes anything, and the postmortem is a one-pager that says 'we are well prepared.' Here is how to run one that is not theatre
-
Why Most Threat Intelligence Programmes Are Not Worth the Money
Threat intelligence is one of the most expensive parts of a security programme and one of the most under-used. Most programmes pay for feeds they do not read, run platforms they do not use, and produce reports that do not change anything. Here is the honest version of the work
-
The Red Team Engagement That Changed How I Think About Risk
There is one engagement in my career that genuinely changed how I think about cybersecurity risk. It was not the most sophisticated operation I have run. It was not the most expensive. It was the one that taught me the most. Here is what it was and what it taught me
-
What I Look For in a Red Team Report
Most red team reports are unreadable. The good ones are gold. Here is what makes the difference, in order, with the parts that most red teamers get wrong
-
Purple Teaming at Scale: How It Changes When You Have 20 Blue Team Analysts
Most purple team advice is written for a team of three. If you scale to twenty, the bottlenecks move, the failure modes change, and the programme either matures or quietly dies on contact with reality. Here is what shifts, and what does not
-
Adversary Emulation vs Penetration Testing: Why the Distinction Matters
You paid €80,000 for a \"red team engagement.\" The report arrived with 47 findings, a 12-page executive summary, and a heat map of your network that looked like something out of a disaster movie
-
How to Write a Purple Team Report That Actually Gets Read
You ran a three-week purple team exercise. Your team worked hard. The red team executed a realistic adversary emulation. Your blue team detected some of it, missed most of it, and the gaps are clear. The debrief went…
-
The 7 Most Pointless Findings in OT Pen Tests
If you run enough OT pen tests, you start to notice a pattern. The report arrives, the client is confused, and the findings have a peculiar quality: technically correct, operationally impossible to remediate, and…
-
Purple Teaming OT: Why \"We Can't Test That\" Is No Longer Acceptable
I keep hearing the same thing in conversations about operational technology security
-
How to Scope a Red Team Engagement That Tells You Something Real
Most red team engagements produce an impressive document and a set of \"critical findings\" that the security team could have predicted before the first phishing email was sent
-
Purple Teaming That Actually Works: A Framework for Real Collaboration
You've got a red team and a blue team. They hate each other
-
Why Your Red Team Tests Are Designed to Fail, And You Don't Know It
Red team comes in on Monday. They've got a scope, a timeline, and a list of techniques to test. By Friday, they've \"successfully executed\" initial access, lateral movement, persistence, and exfiltration
-
Detection Engineering in a Real Environment: Why Generic Rules Fail
I walked into a SOC last month where they'd deployed 847 Sigma rules
-
Your Purple Team Test Failed Because Your Threat Model Is Wrong
You ran a purple team exercise last week. Your red team executed a flawless attack chain: initial access via phishing, lateral movement via Kerberos relay, privilege escalation, and data exfiltration. Picture perfect