Running a purple team without the theatre
Most purple-team exercises are demos for the audience in the room. The useful ones are quiet, repeated, and boring.
If your purple-team exercise ends with a slide deck for the board, you have run a marketing exercise. That is fine, just call it what it is.
The exercises that actually shift detection coverage look nothing like the showcase ones. They are weekly, narrow, and run by the same two people for months.
