Purple Team Exercise Framework (PTEF)

The Purple Team Exercise Framework (PTEF) is the industry standard methodology for designing and executing collaborative security exercises that bring together Cyber Threat Intelligence (CTI), Red Teams, and Blue Teams.

Purple Team Exercises are an efficient method to test, measure, and improve your organization's resilience to real cyber attacks. The framework covers:

• Purple Team Exercises - Ad-hoc collaborative exercises
• Operationalized Purple Team - Continuous virtual team effort
• Dedicated Purple Team - Dedicated staff roles

What's New in v4

PTEFv4 is a comprehensive overhaul focused on practitioner usability:

• Quick-Reference One-Pagers - Printable single-page guides for use during exercises
• Improved Documentation - Streamlined navigation, fixed errors, better organization
• Cloud & Identity Coverage - Cloud environments, identity providers, and modern infrastructure scoping
• AI/ML Threat Guidance - MITRE ATLAS, OWASP LLM Top 10, and AI/ML attack surface coverage
• Detection Engineering Expansion - Detection-as-Code, Sigma rules, CI/CD deployment, detection lifecycle
• ATT&CK v18 Alignment - Updated to Detection Strategies + Analytics terminology
• Broadened Tool Ecosystem - SCYTHE, MITRE Caldera, Atomic Red Team, and The C2 Matrix references
• Continuous Purple Teaming - Automated regression testing, BAS integration, validation metrics