What the Loop Did Before: Penetration Tests, Red Teams, Tabletops and Purple Sessions

All courses / AI Purple / Module 1 / Chapter 2

Learning objectives

After the lesson the participant can:

Classify a testing activity as one of the six baseline forms using the chapter's four questions.
Identify the stage of the loop that each form usually leaves unfinished.
Explain why findings stalled, separating what the sources report from the book's own conclusion.
Draft a testing-forms register with an owner for each unfinished stage and an evidence age for each result.

Key concepts

Six testing forms: The penetration test, the red team engagement, the threat-led test, the tabletop, the purple session and breach-and-attack simulation. They differ in the question answered, who knows, who acts, the output and the cadence.
Stage usually left unfinished: In the book's classification of the common case, the penetration test, the threat-led test and the purple session leave P5 Verify, the red team engagement and the simulation leave P4 Improve, and the tabletop performs no P2 Emulate and leaves P5 Verify.
White team or control team: The group that referees an exercise: it sets rules and metrics, observes and derives lessons. The 2018 TIBER-EU framework says White Team; the current ECB text and the Delegated Regulation say control team. The book uses white team for the control group that governs an exercise.
Trusted agent: One named person on the defended side who knows of the exercise, so that real incidents are not mistaken for it and the stop can be reached. No verified source uses the term in this sense; it is the book's usage.
Testing-forms register: A register (TFR-NR-01, TFR-HM-01) that states for every testing activity its form, cadence, who it informed, what it proved and the stage it left unfinished, with an owner for that stage and an evidence age.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Interactive exercise 1 · Match

Six testing forms and the question each answers

Match each testing form of the baseline with the question the chapter says it answers.

Interactive exercise 2 · Sort

What a result can and cannot show

Each line is a claim someone bases on a test result. Sort it by whether the chapter's evidence table says the named form can show it.

Teaching plan

10 min	The teacher sketches the history of the terms, from the tiger teams of the 1972 study to CBEST, TIBER-EU and the threat-led testing of DORA Article 26.
20 min	Participants fill in a blank version of the map of testing forms in small groups, then compare it with the chapter's table and its column of unfinished stages.
10 min	Teacher-led reading of the table of what each form can and cannot show, with the question to ask of a claim for each form.
25 min	Exercise: build a testing-forms register for the participant's own organisation or extend the Nordvik Region and Hansa Mutual registers.
10 min	Debrief on why findings stalled: the backlog, ownership not matched to the test, and closure with no owner and no test.

Discussion

Hansa Mutual has every testing form and still left P5 Verify to the end. What does that say about adding more forms as a remedy?
A blue team that is unaware measures real detection and response; a blue team in the room learns faster. How should an organisation choose between the two for a given question?
The chapter uses one vendor's dataset only as an indication of a mechanism. How should a team treat a statistic of that kind when it presents its own case to a board?

Written exercise

Exercise · 25 minutes

A testing-forms register

Using the seven steps of the chapter's practical guide, list every activity of the last 24 months in your organisation that was called a test, assessment, exercise, simulation or review of the defence. Classify each as one of the six forms by asking who knew, who acted, whether a technique was actually run and whether the result was a document, a changed control or a shared record. Record the last run, the cadence and the scope, trace where the findings of the last run went, and name the stage each form left unfinished. Participants without access to such records extend the registers TFR-NR-01 and TFR-HM-01 from the chapter's description of Nordvik Region and Hansa Mutual.

Deliverable: A register with a form, a date and an owner per activity, a named unfinished stage per form with its owner, and an evidence expiry, by default 180 days.

Your work

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

Which stage does a breach-and-attack simulation usually leave unfinished, in the chapter's classification?
Show the answer
C. P4 Improve, because a failure is recorded with no one to act on it.
The simulation runs a catalogue on a schedule and records a pass or fail per control and test, but in the baseline there was no one to act on a failure, so P4 Improve is the stage it usually left unfinished.
What can a tabletop show, according to the chapter's evidence table?
Show the answer
A. That the people, roles and plan hold together on paper.
A tabletop is a discussion; it shows that people, roles and the plan hold together on paper and cannot show that any control or detection works. The question to ask is which technical claims the discussion rested on.
Which cause of stalled findings does the chapter put above the others, as its own conclusion?
Show the answer
D. Closure of a finding had no owner and no test to prove it.
The chapter names three causes, the backlog, ownership not matched to the test, and above all that closure had no owner and no test. It labels that conclusion as the book's own.