ALT Very few people go down a path without ever questioning why they are there or whether someone else should be out in front of them. It is okay (and healthy) to have self reflection and questions, but stop letting that get in the way of trying. I mean, come on, we’re hackers! When have we ever let anyone tell us what is or isn’t possible? Stop letting your inner voice do just that.

ALT It is always important to remember that no true adversary is going to be static in their patterns and thus your team and operations need to be adaptable. When we want to really focus in on a very specific, minimal TTP set, we do a mini operation we call a Detection Capability Assessment, with the goal focused more on evaluating the explicit protections and response for a small scope.

ALT If it wasn’t red vs blue, Purple Teams wouldn’t make sense! I believe in the past teams have been weary of “sharing” details because there was too much ego tied into “winning” the operation, on both sides. How do we change this? Stop being an actual adversary! We are only meant to be emulating one. We need to all accept and act like we are all on the same team. Red is a function of defense a.k.a Blue.

ALT It is about raising awareness and visibility to areas of need. If we need to put a number to that, we can speak to the number of operations performed and the explicit risks they identified or highlighted, but we do not like to over focus on that stuff, as it can create perverse incentives.