Skip to searchSkip to main content
APT Security Management

Managed Purple Team Services

Managed Purple Team Services combine offensive attack simulations with direct collaboration between your security team and APT's testers, so your defenses improve in real time rather than after the fact. APT Security Management, based in North Charleston, SC, delivers purple team engagements to businesses across the United States through a prepaid token-based model with no long-term contract required. Unlike a traditional red team exercise where findings are handed over at the end, a purple team engagement keeps both sides in the room throughout, so your defenders learn exactly how attacks unfold and how to stop them.

Who Needs Managed Purple Team Services

Purple team services are built for organizations that already have security controls in place and want to know how well those controls actually hold up. If you have an internal security team, a security information and event management (SIEM) platform, endpoint detection tools, or managed detection and response (MDR) coverage, a purple team engagement tells you what those tools catch and what they miss.


You may be a good fit for this service if your team has completed penetration tests before and wants to go deeper, if you've invested in a detection and response stack and haven't validated it under real attack conditions, or if your compliance requirements (such as SOC 2, NIST CSF, PCI-DSS, or CMMC) call for documented testing of your detection and response capabilities.


Managed Purple Team Services are also a strong fit for businesses preparing for a merger, acquisition, or major audit, where knowing exactly where your security posture stands matters more than ever.

What You Get

All Managed Purple Team Services engagements are priced in tokens. Contact us for a token quote based on your environment and the scope you need covered.

A scoped attack plan built around your actual environment, not a generic checklist

Real-time collaboration sessions where APT testers execute attack scenarios while your team observes, detects, and responds

A documented log of every technique used, mapped to the MITRE ATT&CK framework, so you know exactly what was tested

A clear record of which attacks your tools detected, which they missed, and why

Actionable remediation guidance for every detection gap found, ranked by risk

A final report written for both technical staff and leadership, with findings your team can act on immediately

A retest option to confirm that gaps have been closed after remediation

How It Works

Step 1: Discovery call (free, 30 minutes)

Free 30-minute discovery call to understand your current detection stack, team structure, and goals

Step 2: Token Estimate

APT scopes the engagement and sends a token estimate along with a Statement of Work for your review

Step 3: Token Purchase

Tokens are purchased and a rules of engagement document is signed, establishing clear written authorization for all testing activity

Step 4: Preparation Phase

APT's testers and your security team align on the attack scenarios to run, choosing techniques based on real-world threat actors relevant to your industry

Step 5: Execution Phase

Attack scenarios are executed in live sessions. Your team detects, investigates, and responds in real time while APT provides visibility into what's happening on the offensive side

Step 6: Triage Phase

Gaps are documented immediately after each session, and your team gets guidance on tuning rules, adjusting configurations, or improving response playbooks

Step 7: Reporting Phase

A final report is delivered covering all findings, detection coverage, and recommended next steps

Step 8: Spot Testing

Optional retest sessions are available after remediation to confirm improvements are working

Why APT

APT's testers hold certifications including Offensive Security Certified Professional (OSCP), Certified Ethical Hacker (CEH), and GPEN. They use real attacker techniques, not automated scanner outputs, so your team is tested against the same methods actual threat actors use.


Token pricing means you pay for what you need and nothing more. There are no retainer minimums and no pressure to commit to a 12-month contract. Tokens can also be applied across any APT service, so leftover credits from a purple team engagement can go toward a penetration test, vulnerability management, or compliance work.


APT does not take commissions from technology vendors. If your detection tools have gaps, we tell you about the gaps, not about a product to buy. Recommendations are based on what your environment actually needs.


Your engagement is delivered through one of APT's three tiers, so the reporting format, communication style, and level of strategic involvement are matched to how your team works.

Choose Your Engagement Model

Every APT service is delivered through one of three engagement models:

ravenWing

Email-based updates and scheduled reporting. Ideal for smaller teams that want clear findings without a lot of overhead.

ravenGuard

Client portal access, role-specific reporting for technical and non-technical staff, and scheduled check-in meetings. Ideal for growing businesses that need ongoing visibility.

ravenSentinel

Custom dashboards, collaborative strategy sessions, and direct coordination with your IT and security team. Ideal for enterprises that need a deeply integrated security partnership.

Not sure which fits? Talk to a strategist.

Frequently Asked Questions

What is a purple team engagement and how does it work?

A purple team engagement is a collaborative security exercise where an offensive team (red) and your defensive team (blue) work together in real time. APT's testers execute attack scenarios against your environment while your team observes and responds. The goal is not just to find weaknesses, but to improve your team's detection and response capabilities during the engagement itself, not just after a report is delivered.

How are Managed Purple Team Services priced?

APT uses a prepaid token system instead of traditional retainer contracts. You purchase tokens and spend them on the engagement based on scope, number of sessions, and the complexity of your environment. Contact us for a custom token estimate. There are no long-term contracts and no hidden fees.

How long does a purple team engagement take?

Scope determines length. A focused engagement covering a specific set of attack techniques and a defined environment might run over several days. More comprehensive programs covering multiple threat scenarios and larger environments can run for several weeks. APT will give you a clear timeline as part of the scoping process.

What is the difference between a purple team and a red team engagement?

A red team engagement is a covert simulation where APT's testers attempt to compromise your environment without your security team knowing the timing or scope. The goal is to test whether your team detects and responds on their own. A purple team engagement is collaborative. Both sides are in communication throughout, which makes it more effective for building detection capabilities and training your team, but it does not replicate the element of surprise that a true red team exercise provides. Many organizations benefit from doing both at different stages.

What do I receive at the end of the engagement?

You receive a final report covering every attack technique executed, which techniques your tools detected, which were missed, the underlying reason for each gap, and specific remediation steps ranked by risk. The report is written in two sections: a technical breakdown for your security staff, and an executive summary for leadership. You also receive a MITRE ATT&CK-mapped log of all activity during the engagement.

Do you offer retesting after remediation?

Yes. After your team has addressed the gaps identified during the engagement, APT can run targeted retest sessions to confirm the fixes are working as expected. Retesting is available as an add-on and is priced in tokens.

What types of businesses does APT work with for purple team services?

APT works with businesses across the United States, from growing technology companies and SaaS startups to enterprises in regulated industries like healthcare, financial services, and defense contracting. If you have a security team and detection tooling in place and want to know how well it performs under real attack conditions, this service is built for you.

​​Ready to Get Started?

Book a free 30-minute consultation. We'll review your environment, talk through your detection stack, and give you a clear token estimate with no obligation.

  • Tell us a bit about the specific security needs you're reaching out to solve. All submitted data is encrypted.