One side performs an agreed adversary behavior; the other observes what the environment records and how the defensive process reacts. They exchange context, correct gaps, and repeat the test until the intended outcome is demonstrated.
“Purple team” is an industry label, not a universally standardized team structure. It may describe an engagement, a phase within a red-team exercise, or a continuing way of working between existing red and blue functions. Creating a permanent third team is optional; the defining feature is a deliberate feedback loop between attack emulation and defense.
Key points
HypothesisState the behavior, expected control result, required telemetry, detection logic, and response outcome before testing.
Safe executionUse authorized scope, controlled accounts and data, monitoring, cleanup, deconfliction, and documented stop conditions.
Evidence sharingCompare operator actions with endpoint, identity, network, cloud, and application observations rather than relying only on alert status.
Remediation loopAssign owners, make changes, retest, and preserve repeatable test cases for regression checking.
Important limitationHighly scripted cooperation can validate known scenarios efficiently but does not reproduce all the uncertainty or creativity of an independent adversary.