Red teams break in. Blue teams catch them. Purple team is the arrangement where both sides work together on purpose, with the explicit goal of improving detection rather than winning.
Week 10 is where the program stops separating offense and defense.
Purple Team, Red and Blue Together
In a traditional red team engagement, the red side tries to stay hidden and the blue side finds out afterwards what happened. That has value, but it is slow and it produces a report rather than a fix.
In a purple team exercise, red runs a specific technique, blue watches to see whether anything fired, and then both sides sit down and fix the gap. Then red runs it again. The feedback loop is measured in minutes instead of months.
More detail in red team versus blue team versus purple team.
Detection Engineering, From Investigation to Alert
In Week 9 you found something by hand. Detection engineering asks the obvious next question: how do we find that automatically next time?
A good detection has a clear hypothesis about behavior, a data source that actually contains the evidence, a rule that expresses it, a tolerable false positive rate, and a documented response for the analyst who gets the alert. A rule without that last part just adds noise.
The industry has largely standardized on describing detections against MITRE ATT&CK techniques, and often shares rule logic in the open Sigma format so it can be translated between platforms. Full treatment in detection engineering.
Breach and Attack Simulation
Breach and attack simulation platforms run known attacker techniques against your live environment on a schedule, safely, and report which ones your controls caught. Vendors in this space include SafeBreach, AttackIQ, Cymulate, and Picus. There is also the free, open source Atomic Red Team project from Red Canary.
The point of these tools is not to find new vulnerabilities. It is to answer a question most organizations cannot answer honestly: does the security we already bought actually work? A surprising amount of the time the answer is that a tool was deployed but never tuned, or was excluded from a critical server for performance reasons two years ago.
See breach and attack simulation for how these differ from a pentest.
Autonomous Pentesting and the AI Frontier
Autonomous pentesting platforms go further than simulation. They chain real attacks the way a human tester would, finding a weak credential, using it, escalating, and moving laterally, then showing you the proven path. Horizon3.ai NodeZero is the platform covered on our breach and attack simulation page, and Pentera is another in the same category.
The honest framing is that these tools are very good at the repeatable parts of an assessment and are not a replacement for a skilled human on a scoped engagement. What they change is frequency. An annual pentest becomes a monthly or weekly check.
How AI is changing this further is covered in autonomous pentesting and AI red teaming.
The Challenge: Build and Validate Your Detections
You take findings from your Week 9 investigation, write detections for them, then run the techniques again and see whether they fire.
Most students fail the first pass, and that is the lesson. A rule that looked right in a text editor misses because the field name is different in the real data, or because it matched on a detail specific to that one attack rather than the behavior underneath. Finding that out in a lab is much better than finding it out during an incident.
Learn This at HackRange
Purple teaming is one of the fastest growing areas in security work, because it produces measurable improvement rather than a report that sits in a folder.