Imrpove Detection & Response

Enterprise Purple Team Exercises

Gartner predicts that 60 percent of enterprise security budgets will be allocated toward detection and response by 2020, up from less than 30 percent in 2016. As enterprise security budgets shift to detection and response, ensure that you are getting the most out of technology investments as your security program matures over time.

Purple Team exercises improve the efficacy of your incident response and detection capabilities. In these exercises, Praetorian works alongside your security team while simulating malicious behavior to collaboratively evaluate and improve your organization’s situational awareness. The exercises are designed to programmatically illuminate blind spots in detective capabilities, and then fix them.

Using an iterative approach, we provide tailored recommendations for improving your organization’s ability to detect and respond to a real-world incident. In addition, your team benefits from seeing exactly what known attacks look like through the lens of your tool stack. Ultimately, the goal of the exercise is to reduce or eliminate the time between breach, detection, and remediation.

Purple Team engagements with Praetorian deliver needed tools to track organizational progress, highlight overall strengths and weaknesses, and empower your team with strategic recommendations that guide security road maps.

Solution benefits

• Benchmark detection and response capabilities against MITRE ATT&CK™ Framework.
• Technically validate how security investments are performing against simulated attack behavior in real time.
• Mature your security program by identifying and mitigating gaps in detection and response capabilities.

The MITRE ATT&CK Matrix™

As active contributors to MITRE ATT&CK™, Praetorian utilizes the framework to provide a quantitative, risk-informed measure of how effective certain tools and technologies are in an organization’s defense arsenal. 

Using a customized MITRE ATT&CK Matrix™, Praetorian tracks and visualizes an exhaustive list of advanced persistent threat TTPs executed to comprehensively identify strengths and shortcomings in the organization's detection posture. 

Tiered Improvement Over Time

Praetorian has developed advanced tactics, techniques, and procedures (TTP) automation for many of the ATT&CK tactics. Through automation, the exhaustive inventory of attacks can be executed in a relatively short period of time against an environment to accelerate the feedback cycle.

Praetorian further categorizes the TTPs into four tiers based on frequency of use by an advanced persistent threat (APT) and the priority with which the organization’s ability to detect them should be assessed.