{"id":28481,"date":"2025-12-10T16:40:14","date_gmt":"2025-12-10T15:40:14","guid":{"rendered":"https:\/\/www.riskinsight-wavestone.com\/?p=28481"},"modified":"2025-12-10T16:40:16","modified_gmt":"2025-12-10T15:40:16","slug":"purple-teaming-for-ot-how-to-switch-from-a-compliance-to-a-performance-mindset","status":"publish","type":"post","link":"https:\/\/www.riskinsight-wavestone.com\/en\/2025\/12\/purple-teaming-for-ot-how-to-switch-from-a-compliance-to-a-performance-mindset\/","title":{"rendered":"Purple Teaming for OT:\u00a0\u00a0How to switch from\u00a0a compliance\u00a0to a\u00a0performance\u00a0mindset?"},"content":{"rendered":"\n

In our\u00a0previous\u00a0articles of this OT cybersecurity monitoring series\u00a0(<\/span>Cybersecurity monitoring\u00a0for OT<\/span><\/a>\u00a0\/\u00a0<\/span>Cybersecurity tooling strategy<\/span><\/a>),\u00a0we explained the current state of OT detection capabilities and discussed the right tooling strategy.<\/span>\u00a0<\/span><\/p>\n

This third article focuses on a key question:\u00a0<\/span>how do you measure the efficiency of your OT detection?<\/span><\/b>\u00a0<\/span><\/p>\n

From compliance to efficiency: a KPI\u00a0paradigm shift<\/span>\u00a0<\/span><\/h1>\n

KPI stands for\u00a0<\/span>Key Performance Indicator.\u00a0<\/span><\/i>However, we tend to create KPIs\u00a0to\u00a0monitor\u00a0progress\u00a0against\u00a0our\u00a0plans, not\u00a0real\u00a0performance. While\u00a0useful,\u00a0monitoring\u00a0only deployment or coverage\u00a0(number of sites connected\u00a0to the SOC, EDR deployment on OT machines, number of probes registered to the management console)\u00a0<\/span>tells you\u00a0very little\u00a0about the actual ability of your SOC to detect a real attacker.<\/span><\/b>\u00a0<\/span><\/p>\n

So, how confident are you in your detection tools, use cases, and processes?\u00a0The only way to be sure is simple:\u00a0<\/span>test them.\u00a0<\/span><\/b>And\u00a0the best way to test them is through\u00a0<\/span>Purple Team exercises<\/span><\/b>.<\/span>\u00a0<\/span><\/p>\n

What is Purple Teaming in OT?\u00a0<\/h1>\n

A Purple Team exercise is a\u00a0<\/span>collaborative mission<\/span><\/b>\u00a0between the Red Team (attackers) and the Blue Team (defenders).\u00a0Unlike a traditional Red Team assessment, where the defenders are kept in the dark and evaluated afterward,\u00a0<\/span>a Purple Team exercise is an iterative, joint effort<\/span><\/b>.<\/span>\u00a0<\/span><\/p>\n

This collaborative approach allows both teams to:<\/span>\u00a0<\/span><\/p>\n