SCYTHE's framework for building a purple team program

SCYTHE’s Purple Team Exercise Framework is a structured methodology for building and maturing Purple Team programs, from ad-hoc exercises to operationalized purple teaming to a dedicated team. It covers roles, planning meetings, CTI-led adversary emulation down to the procedure level, exercise execution and lessons learned. Its Purple Team Maturity Model rates a program on threat understanding and detection understanding, each across three levels: deployment, integration and creation. Expect the odd SCYTHE product plug along the way; it is their framework, after all. EU financial entities will meet the concept anyway: the TIBER-EU Purple Teaming Guidance from January 2025 makes a purple teaming exercise a standard element of the closure phase of every TIBER test, with limited purple teaming during active testing only as a last resort.