Topic starter
18/08/2026 2:37 pm
TL;DR: Continuous purple teaming only works when validation is automated, procedure-level tracking is precise, and detection engineering is treated like software, according to Sprocket Security’s interview with Northwestern Mutual’s Gary Lobermier. The operational lesson is that manual exercises and static coverage claims quickly decay as environments, tools, and attacker techniques change.
Editorial analysis by NHI Mgmt Group, based on content published by Sprocket Security: “Ahead of the Breach - Gary Lobermier, Lead Adversarial Security Engineer at Northwestern Mutual”.
Key questions
Q: What breaks when purple team validation is still manual?
A: Manual purple teaming breaks when the environment changes faster than the test cycle.
Q: Why does procedure-level tracking matter in detection engineering?
A: Procedure-level tracking matters because attackers do not use techniques in the abstract, they use specific implementation variants.
Q: What are the signs that purple team coverage is failing?
A: Common signs include repeated passes on high-level techniques, stale test results after infrastructure changes, and detection gaps that keep reappearing in the same control area.
Practitioner guidance
- Automate recurring validation runs Schedule attack simulations on a fixed cadence across Windows, macOS, Linux, and cloud instances so detection gaps are surfaced as change happens, not after an annual review.
- Track procedures separately from techniques Record which procedure variant was executed for each test so a pass on a high-level ATT&CK technique does not mask incomplete behavioural coverage.
- Tie validation to detection engineering backlogs Route every failed test into the same remediation workflow you use for production detections, with owners, due dates, and retest criteria.
Bottom line: Continuous purple team programs only add value when validation is current, repeatable, and tied to how detections behave after change.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:22 pm
Continuous validation is becoming a control discipline, not a red-team exercise. The article shows that purple teaming only becomes operationally useful when it is treated like software testing with repeatable execution, versioned inputs, and measurable outcomes. That shifts the governance question from whether a test was run to whether the control still works after change. Practitioners should measure detection assurance as a living control state, not an annual event.
A question worth separating out:
A: Security teams should use continuous attack simulation to test controls end to end, not as isolated point checks. The goal is to see how email security, perimeter defenses, detection logic, and response workflows behave together under realistic attack paths. That approach exposes control gaps faster, shows where a single weakness cascades, and helps prioritise remediation based on real exposure across the kill chain.
👉 Read our full editorial: Continuous purple team validation is becoming an engineering discipline