Read as
Last updated: April 29, 2026
One-shot red team engagement: report → file in drawer. Purple-team handoff: report → workshop → detections built. The latter is what produces lasting improvement.
One-shot red team engagement: report → file in drawer. Purple-team handoff: report → workshop → detections built. The latter is what produces lasting improvement.
The handoff workshop
- Red team walks through engagement chronologically
- For each step: blue team confirms what (if any) signal fired
- Where signal fired but ignored — investigate why
- Where no signal fired — design new detection
- Each detection assigned an owner
- Re-test detections within 30 days
The output
- Detection backlog with priorities
- Updated MITRE ATT&CK coverage map
- SIEM/EDR rules drafted
- Tabletop scenarios derived from real engagement
🧠
Check your understanding
Module Quiz · 4 questions
Pass with 80%+ to mark this module complete. Unlimited retries. Each question shows an explanation.
Want this for your team?
Custom team training + practitioner advisory
Beyond the free academy — we run private workshops, vCISO advisory, and red-team exercises tailored to your stack. For Indian SMBs scaling past their first hire.
Book team training call
Replies in 4 working hrs · India-only · Senior consultants