Planning and scope
We define the exercise objectives, critical assets, tools involved, attack hypotheses, rules of engagement and operational limits.
Purple Team Assessment
Can your company detect a real attack while it happens?
We bring the Fortis Aegis Red Team together with your company's Blue Team to simulate real attack techniques, identify detection gaps in real time and strengthen your environment's response capabilities.
01Collaborative execution with the Blue Team
02Identification of gaps and blind spots
03Real-time alert validation
04Creating and tuning detection rules
What is Purple Team Assessment
Test your defenses together with those who need to operate the response.
A Purple Team Assessment is a collaborative engagement in which the Fortis Aegis Red Team executes controlled attack techniques while the client's Blue Team monitors, validates, investigates and improves its detection and response capabilities in real time.
Unlike a purely offensive simulation, the objective is not just to discover how far an attack could advance. The focus is to understand what your company can see, what goes unnoticed and which rules, alerts and settings need to be improved to detect a real attack.
Many organizations have excellent security tools, such as EDR, SIEM, XDR, WAF, cloud security solutions and monitoring platforms. Yet they fail to transform these capabilities into effective operational visibility.
Having technology is not enough.It is necessary to build detections capable of revealing real adversary behavior, reducing blind spots and preparing the team to act with precision.
How it works
From adversarial simulation to actual detection improvement.
Each stage is conducted in a controlled, collaborative manner and aligned with the client's environment, with a focus on learning, operational improvement and strengthening defenses.
Visibility mapping
We evaluate which sources of telemetry, logs, alerts, integrations and controls are available for the Blue Team to track execution.
Execution controlled by the Red Team
The Fortis Aegis Red Team executes techniques compatible with real attacks, simulating adversary behavior in an authorized environment.
Real-time validation
The Blue Team tracks events, investigates alerts, identifies visibility gaps, and validates whether tools are generating useful signals.
Rule construction and adjustment
We work closely with the customer team to create, tune, and validate new detection rules, correlations, alerts, and advanced configurations.
Debrief and evolution plan
We consolidate learning, gaps found, improvements applied and recommendations to increase detection and response maturity.
Capabilities assessed
A practical view of your real detection capabilities.
The Purple Team Assessment can be adapted to the organization's objectives, available tools and main risks in the environment.
Detection coverage
Validation of the ability to identify suspicious behaviors, adversarial techniques and relevant events during execution.
Rules and correlations
Analysis and improvement of rules in SIEM, EDR, XDR, cloud security, WAF and other monitoring platforms.
Operational blind spots
Identification of uncollected events, missing logs, silent alerts, incomplete integrations, and poor telemetry quality.
Response and investigation
Assessment of the team's ability to investigate signals, correlate events, understand the attack and make decisions during the exercise.
Advanced configurations
Technical adjustments to increase visibility, improve alerts, reduce noise and increase detection accuracy.
Readiness for real attacks
Building practical knowledge so that the Blue Team can recognize patterns, investigate faster and respond with more confidence.
Practical validation
Talk to an expert
Strong tools only generate value when they deliver real visibility.
Deliverables
Improved detection. More prepared teams. More mature defense.
The result connects offensive simulation, defensive validation and practical improvement of security operations.
- Detection gap mapClear view of blind spots, undetected events and visibility gaps identified during the exercise.
- Defensive coverage matrixRelationship between techniques performed, alerts generated, telemetry sources, tools involved and response capacity.
- Rules created or adjustedRecommendations and adjustments to improve detections, correlations, alerts and configurations in the tools used by the customer.
- Technical evidence of executionRecord of actions performed, expected signals, observed signals and gaps found during the simulation.
- Operational improvement recommendationsDirections to strengthen logs, integrations, playbooks, investigation and response processes.
- Technical debrief with the Blue TeamCollaborative session to review results, explain techniques performed and consolidate practical learning with the team.
Next step
Turn security tools into real detection capabilities.
Talk to Fortis Aegis to structure a Purple Team Assessment aligned to your organization's tools, risks, critical assets and security objectives.
Request Purple Team Assessment