Find out what your monitoring really sees — and fix it before anyone leaves the room.
Our red and blue teams work with your defenders in the open. Agreed techniques are simulated safely, every one is scored as detected, noisy or missed, gaps get new detections the same day, and the technique is re-run to prove the fix fires.
A red team works in secret and asks one question: would you notice? A purple team works in the open and asks a more useful one: what did your monitoring actually see? Our testers announce each technique, simulate it safely, and sit next to your defenders while they watch the console.
Every technique ends up in one of three buckets — detected properly, detected but buried in noise, or not seen at all. That list is the real deliverable. A miss gets a detection written on the spot, the technique is run again, and the gap only counts as closed when something fires. Two focused days of this usually move your detection coverage further than weeks of covert testing.
Techniques picked for your sector and estate — not a generic library run end to end.
Your defenders watch the console live while each technique is simulated.
Detected, noisy or missed — with the telemetry captured at the moment it ran.
New rules drafted and backtested against your own history during the exercise.
The technique is repeated to prove the new detection fires.
Coverage tracked by tactic, so the next exercise measures movement.
They are often used interchangeably. They answer different questions, cost different amounts and leave you with different things.
A small team chases an agreed objective without warning your defenders. It tells you, realistically, whether an intrusion would be spotted.
Your monitoring, detection content and the people who respond. It is not bought as an exercise — it is the capability every exercise is testing.
Attack and defence in one room, openly, with the single goal of improving detection. Cheaper than red, faster to change things, and easy to repeat.
Rule of thumb: buy purple to improve detection; buy red to measure how good it already is. Running a red team first often just confirms the gaps a purple exercise would have found — and fixed — in two days.
A common model supplies the attack half and expects you to supply the defence. Without detection engineers in the room, the exercise turns into a red team with commentary and the improvement half stalls.
XcellHost runs a 24×7 NOC & SOC in Mumbai and writes detection content for live environments every week — so we can staff both sides. If you have your own detection engineers, bring them; they pair with ours.
People who write and tune production detection rules as their day job, not only testers.
Rules tuned to your data sources and noise, backtested on your own history — not pasted from public rule sets.
The technique is re-run after the rule is deployed. A gap is closed only when something fires.
Every result mapped to MITRE ATT&CK tactics, so the next exercise shows what moved.
Scoping happens first, in writing. Then the exercise itself follows the same five phases every time.
From your threat profile, your sector and the behaviour actually seen against similar Indian organisations. Agreed and signed off in the rules of engagement.
Testers operate, defenders monitor, everyone sees both screens. Remote over a shared bridge, or on-site at your office.
Each technique is simulated safely and scored detected, noisy or missed, with the telemetry recorded at the time.
Detections written and backtested for every miss; rules that fired but flooded the queue are tuned.
Techniques repeated to confirm the fixes, then an ATT&CK coverage map and a plain list of what changed.
Choose a profile to see the kind of scenarios we typically prioritise. Every scenario is described by ATT&CK tactic and outcome only — the exact simulations are agreed privately in your rules of engagement.
Scenarios are illustrative examples of what a scope can contain. Final technique selection depends on your estate, your logs and your rules of engagement.
Short, focused exercises run twice a year beat one long engagement. Pick a format to see a typical agenda.
Threat profile, 8–12 techniques, data sources checked, written authorisation signed.
Telemetry checks, who watches what, first technique set run and scored.
Remaining techniques; detected, noisy and missed list built live.
Detections drafted and backtested for misses; noisy rules tuned.
Every technique repeated; coverage map and change list walked through.
Report, detection content handed over, prioritised next actions.
Up to 30 techniques across identity, endpoint, email, cloud and network.
Telemetry gaps logged before any detection work starts.
Rolling cycles per tactic group; detection engineers pair with your SOC.
Triage and escalation walked end to end for the most important detections.
Everything repeated; a 30-minute briefing for CISO and leadership.
Coverage map, change list, detection backlog and a 90-day plan.
A 2- or 5-day exercise sets the baseline coverage map.
Our engineers write and tune rules from the backlog with your SOC.
Short technique re-runs prove last quarter's detections still fire.
After a migration, acquisition or new platform, affected techniques are re-run.
A complete purple exercise measures movement by tactic.
One ATT&CK coverage view across every cycle.
SOC analysts, a detection or SIEM owner, and IT/cloud admins on call.
Exercise lead, testers, detection engineers from the XcellHost SOC.
Shared bridge from Mumbai, or in your office anywhere in India.
The right alert, the right severity, routed to the right queue. We record the evidence so it counts towards your coverage map.
The rule fired, but alongside dozens of false positives. We tune thresholds, scoping and enrichment so the true alert stands out.
No alert at all. First we check the telemetry exists; then we write a detection, backtest it on your history and re-run the technique.
You keep every detection, tuning change and runbook note written during the exercise — in your SIEM, in your tenant.
Answer honestly — it takes about a minute. The radar redraws as you go and suggests the exercise that fits.
Your recommended next step appears here.
Purple teaming is a defensive validation service. Nothing runs until the scope and rules of engagement are signed by someone with the authority to sign them.
Signed by an accountable owner on your side before any activity, naming the systems, accounts and people involved.
Techniques, windows, test accounts, out-of-scope systems and escalation contacts agreed up front.
Simulations are safe by design. Anything with operational risk is emulated or run in a window you control.
Either side can pause instantly. Unexpected behaviour stops the run until both leads agree how to continue.
Test accounts and synthetic data only. Evidence stored encrypted, shared on a need-to-know basis and deleted on an agreed date.
Reports describe results by ATT&CK tactic and outcome. Simulation detail stays in an access-controlled annex for your engineers.
Hover or tap a card for detail.
Purple team results are evidence that your detection and response actually works — the kind of evidence regulators and auditors increasingly ask for.
Test detection against the fraud and account-takeover behaviour your sector sees most.
Evidence detection and response capability for cyber-resilience reviews.
Protect patient and policyholder data where downtime is not an option.
Validate IT-side detection around plants and ERP without touching OT.
Prove detection across cloud tenants and customer-facing platforms.
See what your provider — or your new SIEM — really catches.
CERT-In directions (2022) — report specified incidents within six hours. Exercises prove your SOC spots them in time.
CERT-In log retention — we check the logs your detections need are actually kept and queryable.
Indicative — confirm with XcellHost. INR, excl. 18% GST. Scope and fee are agreed in writing before anything runs.
*Indicative placeholder price · excl. 18% GST · to be confirmed by XcellHost. On-site delivery outside Mumbai: travel and stay billed at actuals.
Pick techniques, days, teams and delivery. The plan redraws live; a standard workshop can go straight into the cart, anything larger becomes a quotation request.
Purple Team Assessment brings attackers and defenders together under an agreed scope. Written authorisation, controlled simulations and documented evidence keep each exercise focused on improving your detection capability.
Confirm the systems, accounts and techniques in scope before an exercise begins.
Agree exercise windows, escalation contacts and stop conditions with your defenders.
Use test accounts and synthetic data; emulate techniques where a live test would create operational risk.
Agree who can access findings, where evidence is held and how long it is retained.
Map the selected techniques and observed detections to the agreed threat profile.
Record detected, noisy and missed techniques, tune the detections and re-run to validate the result.
XcellHost is ISO 27001 and ISO 20000-1 certified · 24×7 NOC and SOC. Agree evidence residency and regulatory requirements during scoping.
Testers and detection engineers from the same team that runs our SOC.
01Detection content written for live environments every week, not just for exercises.
02Written authorisation, rules of engagement and stop conditions every time.
03Certified security and service management behind how we handle your evidence.
04Fixed-fee workshops billed in rupees, input-tax-credit friendly.
05Mumbai managed cloud and security, comfortable with Sentinel, Defender and the rest of your stack.
06A red team is covert and objective-led; it tells you whether you would notice an intrusion. A purple team is open and technique-led; attackers and defenders work together so every gap in detection is found, fixed and re-tested during the exercise.
A facilitated session where agreed techniques are announced and simulated safely while your defenders watch their monitoring. Each one is scored detected, noisy or missed; gaps get detections written and backtested, and the technique is run again to confirm.
Usually two to three days for a focused set of techniques, plus scoping beforehand and a written report after. We generally recommend shorter exercises twice a year over one long engagement.
No. XcellHost staffs both sides — testers and detection engineers from our SOC. If you have your own engineers, they are welcome and usually get the most out of it.
Usually not. Closing the gaps a purple exercise finds first makes a later red team far more informative — it then tests a detection capability you have already improved.
Yes, within the rules of engagement. Techniques are agreed in advance and simulated safely; anything with operational risk is emulated or run in a window you control, using test accounts and synthetic data, with stop conditions either side can call.
A technique-by-technique score, the detections written during the exercise, tuning applied to noisy rules, an ATT&CK coverage map by tactic, a plain change list and a leadership readout. You keep all the detection content.
Twice a year is typical, plus after major changes such as a cloud migration, an acquisition or a new SIEM or EDR. Coverage decays as estates change, so the trend between exercises matters more than any single score.
Microsoft Sentinel, Microsoft Defender XDR, Splunk, IBM QRadar, Elastic Security, CrowdStrike Falcon and XcellHost's own Vortex SOC and Scrutiny EDR, among others. Detections are written in your platform's own rule format and stay in your tenant.
Breach & attack simulation runs automated, safe simulations continuously to check controls still work. A purple team is a people-led exercise that improves detection. Many clients use BAS between purple exercises to catch drift.
It produces evidence that your detection and response works — useful for CERT-In's six-hour reporting and 180-day log retention directions, RBI cyber security directions, SEBI's CSCRF, IRDAI guidelines and DPDP Act safeguards. It helps you meet them; it does not certify compliance.
Yes. Exercises are invoiced in Indian rupees with 18% GST, so you can claim input tax credit.