Operating Cadence
Bi-weekly micro-exercises: choose 1–2 techniques, execute, capture telemetry gaps, draft detection, validate in staging, promote. This feeds directly into the Detection Engineering Playbook.
Roles & Responsibilities
Offense crafts scenario & success conditions; defense instruments telemetry & authors analytic; facilitator tracks metric deltas.
Detection Engineering Loop
Each exercise must end with either production analytic, backlog refinement, or capability ticket (telemetry/enrichment).
Coverage Dashboard Integration
Auto-update ATT&CK coverage and hypothesis status directly from exercise issue templates.
Metrics
Exercise to production detection conversion %, false negative reduction trend, lateral movement dwell delta, analytic retirement ratio.
Sources & Further Reading
MITRE ATT&CK.
Atomic Red Team.
Purple Team Exercise Framework references.
Key takeaways
Smaller, fast loops outperform quarterly mega-exercises for sustained uplift.
Further reading
Cybersecurity
Want this reviewed for your systems?
Tell us about your systems and deadlines. We reply with a proposed scope and next steps.