Specialist / enquire
Purple Team Exercises
Collaborative attack-and-defence exercises that turn observations into improved visibility.
A purple team exercise places offensive and defensive specialists in the same feedback loop. Techniques are executed transparently, telemetry is inspected in real time and detections are tuned or designed while the behaviour can be reproduced safely.
Founder-led technical delivery
Why Safestorm for this assessment
Felix uses offensive testing to explain what happened at the host, identity and network layers, helping defenders separate missing telemetry from weak analytics or response workflow. The goal is measurable control improvement, not a pass-or-fail score.
- More than six years’ offensive-security experience
- OSCP and OSEP certified
- Red teaming, adversary simulation and control validation
- Published IPv6 research presented at BSides London
Felix’s prior experience includes identifying high-impact weaknesses in healthcare environments. Client identities and engagement details remain confidential.
What the assessment covers
Final coverage is agreed during scoping and reflects your technologies, user roles, threat model and operational constraints.
- Joint selection of high-value attacker techniques
- Repeatable execution with defender visibility
- Endpoint, identity, network and cloud telemetry review
- Detection logic, enrichment and triage workflow testing
- Re-execution to verify agreed improvements
Common risks identified
Testing is not limited to this list. These examples illustrate the types of material risk the assessment is designed to uncover.
- Preventative controls that can be bypassed by realistic attacker behaviour
- Security activity that is not visible to the expected monitoring controls
- Response procedures that do not operate as expected under test conditions
A controlled process
How the engagement works
- Step 1
Define objectives, threat assumptions and success criteria
- Step 2
Design scenarios, safeguards and rules of engagement
- Step 3
Prepare stakeholders, communications and stop conditions
- Step 4
Perform controlled testing and collect proportionate evidence
- Step 5
Analyse control performance, visibility and response
- Step 6
Debrief stakeholders, prioritise improvements and verify agreed changes
Who this service is suitable for
- Organisations with a defined assurance objective and authorised scope
- Security teams seeking focused validation beyond a conventional penetration test
Not sure whether this is the right assessment? Safestorm can help define the assurance question before recommending a scope.
Methodology and industry references
Testing is risk-led and tailored rather than reduced to a checklist. Relevant, recognised guidance helps structure coverage and communicate results.
Referencing a framework does not represent certification against it or guarantee compliance with every control.
Frequently asked questions
How is the engagement scoped?
Safestorm begins with an objectives workshop and prepares a tailored proposal and rules of engagement. No assumptions are made about techniques, targets or operational risk.
Is a fixed price available?
A quote follows scope definition. Specialist requirements vary materially, so the proposal reflects the agreed scenario, duration and safety requirements.
Define the right scope
Tell us what you need to assess, your timescale and the assurance outcome you need. We will propose a proportionate scope and clear rules of engagement.
Discuss your requirements