Ryan Basden @ryanbasden.com · Mar 17 Purple team exercises are my favorite work when they go well. Few things burn me out harder than when they're set up to fail and I have to run them anyway. I wrote up the specific failure modes I've seen repeatedly, on both the client side and the consulting side. 🧵
0 likes 1 replies
?
Replies
The client-side ones are what you'd expect: teams using the engagement as an EDR benchmark rather than testing their actual detection capability, no threat intelligence informing what techniques to run, and reports that went to SharePoint instead of a ticketing system.