Security penetration testing provider SpecterOps Inc. today became the latest company to offer a “purple team” assessment, a sign that the collaborative approach to cybersecurity is catching on.

The concept refers to using both defensive and offensive measures to understand the weak spots in a customer’s infrastructure, and to shore up defenses to prevent future attacks. In security patois, these teams are respectively referred to as blue and red teams, hence the combined color purple. For many security assessments, the two teams are deliberately kept apart, but the purple concept is to have the same people working both sides.

This collaboration has some distinct advantages, such as being able to share feedback between the two sides and work toward common goals. CrowdStrike Holdings Inc. breaks the roles down in its blog post earlier this year, as shown here.

“A purple team focuses on enhancing cyber defense capabilities through realistic attack simulations, knowledge transfer and remediation, and collaboration with other security personnel,” Evan Pena, a managing director at Google LLC’s Mandiant unit, explained to SiliconANGLE. “The goal is to improve the organization’s ability to prevent, detect and respond to cyber threats effectively.”

In contrast, he added, “a red team operates independently and simulates real-world cyberattacks on an organization without prior knowledge. Unlike the collaborative approach of a purple team, a red team operates as an external threat actor, providing valuable insights into potential security risks.”

However, the color purple isn’t for everyone. “I wonder how many companies are actually mature enough for effectively using such a service offering,” Tanya Janca (pictured, adjacent) told SiliconANGLE via email. She runs an application security consultancy called We Hack Purple and has spoken and written about the concept frequently. “I find that a lot of companies are at the start of their journey, rather than near the end, and purple teaming is a mature activity.”

Several security providers have free purple tools that can be used to conduct these exercises. Others have commercial offerings, including GuidePoint Security LLC, Mandiant and AttackIQ Inc. That last company has run an annual “purple hats conference” with a full lineup of various experts for the past three years.

Images: Flickr, Crowdstrike; photo: WeHackPurple