Purple Team Exercises
Collaborative red + blue team exercises that validate your detection and response capability against real adversary TTPs — running side-by-side with your SOC analysts so every missed alert becomes a tuned rule before the engagement closes.
- Quote SLA48 hours
- Typical engagement5–15 working days
- RetestFree within 30 days
- Reporting formatCERT-In + ISO + SOC 2 ready
- Team100% in-house · OSCP / OSWE / OSEP
A Purple Team engagement, in plain language.
Most red team reports tell you what got missed. A purple team engagement makes sure it stops getting missed. Macksofy red operators execute a MITRE ATT&CK-aligned playbook in agreed phases — initial access, persistence, lateral movement, exfiltration — with your SOC watching live. When a technique slips past detection, we pause, write the rule together, replay, and confirm the alert fires. The output is a tuned SIEM, a measurably hardened MITRE coverage map, and SOC analysts who have seen the attacker's actual tradecraft.
- Convert red team findings into shipped detection rules — not next-quarter remediation tickets
- Measurable MITRE ATT&CK coverage improvement (baseline → target) with evidence
- Train Tier-1 and Tier-2 SOC analysts on real adversary tradecraft, not vendor demos
- Build the executive evidence pack: '92 ATT&CK techniques tested, 78 detected, 14 hardened'
Phased delivery — every step documented.
Interactive walkthrough of how we run a Purple Team engagement — tap a phase to expand its activities.
1 · Pre-engagement
- Threat-model intake: industry-relevant APTs and ransomware families
- MITRE ATT&CK baseline assessment of current detection coverage
- Joint engagement charter signed by red + blue + IT leads
Industry-standard + custom.
We use the same tooling top BFSI red teams operate — combined with Macksofy in-house extensions and proprietary scripts where commercial tools fall short.
Sectors we operate in
What you get
- MITRE ATT&CK coverage heatmap (before / after)
- Per-technique evidence pack (red PoC + blue detection rule shipped)
- Tuned Sigma / Splunk / Sentinel / Wazuh rule set
- Detection engineering runbook + future-cadence recommendation
- Free 30-day retest of the hardened rule set
- Executive coverage delta report
Anonymized engagement snapshots.
Scope · 5-day on-site purple team across AD + endpoint + email gateway
Finding: Lifted ATT&CK coverage from 47% to 71% across 18 techniques; shipped 14 new SIEM rules during the engagement
Material — passed RBI System Audit detection-control test on the same quarter
Scope · Phishing → lateral → exfil scenario with managed SOC live in the loop
Finding: Discovered that EDR detected the technique but the alert never reached the SOC queue (broken connector) — fixed mid-engagement
Critical — silent detection-pipeline failure that would have hidden a real ransomware precursor
Transparent tiers. No surprises at quote time.
Indicative price ranges based on typical Indian engagements. Final fixed-price quote within 72 hours of the discovery call.
Focused
- Manual + tooled testing
- CERT-In format report
- Free 30-day retest
Stack
- Everything in Focused
- Web + API + mobile coverage
- Executive + technical briefings
Programme
- Everything in Stack
- Quarterly cycles + post-release retests
- Same consultants throughout
Note · Indicative pricing in INR. Final quote depends on scope, asset count and engagement window. Fixed-price proposal within 72 hours.
Rated 4.9 ★ from 612 client reviews.
“We've worked with three Big 4 firms before Macksofy. None found what their team did in our payments stack. The most actionable report we've received in a decade.”
“The CHFI training Macksofy delivered for our cyber cell raised investigation quality measurably. Practical, India-context-aware, and respectful of our operational realities.”
“Came in with zero security background. 5 weeks later I was running Burp Suite and Metasploit confidently. Cleared CEH on the first attempt.”
Things people ask before signing.
Often paired with this engagement.
Get a fixed-price proposal in 48 hours.
Tell us about your security need — pentest, audit, training or a wider engagement. A senior consultant will reply within a few business hours.
- CERT-In Empanelled
- EC-Council ATC · CompTIA Authorized
- 20,000+ professionals trained
- India + UAE engagements