Offense · Purple-Team

Attack yourself to prove your defense works

02/07/2026 · ~7 min read

CampaignsPurple-TeamMITRE ATT&CKRoEDAST

You can install every defensive tool in the world — and still not know whether they actually work. The only way to know is to attack yourself and see whether the alert fires. But attacking without boundaries is a risk in itself. Here's how we did it right.

The problem: an untested defense is hope

A business installs antivirus, a firewall, and monitoring — and assumes they're protected. But does the firewall actually block? Does the alert about a break-in attempt actually arrive, and in how many seconds? Without active testing, these are assumptions. And when a real attack arrives, you discover the answer the most painful way.

The gate before everything: signed authorization (RoE)

Before we run even a single scan against a target, there's a signed authorization gate (Rules of Engagement). Without a signed digital consent form covering the target — no active testing runs. The gate also enforces a time window and a revoke option. This isn't bureaucracy: it's the same evidence of consent that regulation like Amendment 13 demands, and it's the legal protection for us and for the customer. A real DoS? Always refused — at most a controlled load test.

The principle: we defend, we don't "hack back". Every active action goes through a signed, documented, and revocable consent gate. Full transparency with the customer.

What we built: a campaign launcher

Instead of running one test at a time, we built a campaign launcher that orchestrates many tests together — a matrix of target × method. One method, for example, is web application penetration testing (detecting SQL injection with sqlmap and DAST scanning). Each campaign runs against the list, collects findings, and sends them up to the same unified security dashboard where all the rest of the information lives.

The heart: a Purple-Team coverage matrix

This is where the magic happens. We took all of our detections (what the defense knows how to catch) and mapped each one to a technique in MITRE ATT&CK — the universal dictionary of how attackers actually operate. The result is a coverage matrix: a board that shows exactly which attack techniques we detect, and where the gaps are. "Purple-Team" = combining the red side (offense) with the blue side (defense) in a single loop.

Why it matters for the business: "we installed a defense" is a claim. "we tested 12 attack techniques, detected 12, and the alert fired in 8 seconds" — that's proof. That's what convinces a customer, and that's what a cyber insurer wants to see.

The three points of proof that close a deal

"Here's your exposure" — an external scan that shows what an attacker sees.
"Here's the fix — from 62 to 88" — a before/after hardening score.
"We proved the alert fires on your server" — the coverage matrix in action.

How we tested it

We ran the first attack method (SQLi detection + DAST) against an authorized test target, and found a real vulnerability — which proved the end-to-end path works: launcher → authorization gate → test → finding in the dashboard. At the same time, the RoE gate proved itself: with no signed authorization, no test runs.

How we keep improving it — continuous quality control

The coverage matrix is alive: as we add detections, the coverage grows and the gaps shrink. Next steps: scheduled detection validation (BAS — Atomic Red Team on a safe subset) that runs attack techniques and verifies the alert fired, trend tracking of the coverage percentage over time, and a controlled load test as a safe substitute for DoS. We attack ourselves — so that nobody else has to.

This article describes the approach at a principle level. All of our offensive activity is controlled, signature-authorized, and revocable; we do not expose tools, payloads, or details that would help an attacker.

← All articles