# PTEF is the paperwork behind a purple team exercise > The Purple Team Exercise Framework from SCYTHE is a methodology document set for running collaborative exercises where a red team and a blue team work from the same threat intelligence, with planning phases, a CTI process, a maturity model, printable one-pagers and templates. It suits organisations that run exercises and want a repeatable process rather than a tool. **scythe-io/purple-team-exercise-framework** — Purple Team Exercise Framework - Repository: https://github.com/scythe-io/purple-team-exercise-framework - Website: https://scythe.io - Stars: 827 · Forks: 130 - Language: PowerShell - License: MIT - Published: 2026-10-20 · Updated: 2026-10-20 · Language: en - Canonical page: https://hysenlabs.com/projects/scythe-io-purple-team-exercise-framework ## A methodology rather than a piece of tooling The Purple Team Exercise Framework is described as the industry standard methodology for designing and executing collaborative security exercises that bring together Cyber Threat Intelligence, Red Teams and Blue Teams, and the description calls purple team exercises an efficient method to test, measure and improve an organisation's resilience to real cyber attacks. What the repository actually is becomes clear from its contents. There is no application to install and no interface to drive. The deliverable is a set of documents, printed guides and templates, with the primary language of the repository listed as PowerShell, which is a reminder that the practical side of a purple team exercise still lives in the tools people bring to the table. The framework is the process around that work, and it was created by SCYTHE, with the README saying it has been used by enterprises, consulting companies and managed service providers worldwide. ## Three operating models, not one The framework covers three shapes of purple teaming, and the distinction is the first thing to get right when you are deciding which one you are running. Purple Team Exercises are ad-hoc collaborative exercises, which is the familiar model of a scheduled event where both sides sit down together. An Operationalized Purple Team is a continuous virtual team effort, where the collaboration happens as part of normal operations rather than in a scheduled window. A Dedicated Purple Team means dedicated staff roles, so the capability sits inside the organisation rather than being borrowed for the day. The cost and the reporting burden differ sharply between the three. An ad-hoc exercise produces a document, a set of findings and a lessons learned session. An operationalized team produces a continuous stream of detection work, and a dedicated team produces a function with a budget, which is a different kind of commitment than a project. ## What changed in version four The v4 release is described as a comprehensive overhaul focused on practitioner usability, and the change list reads like a response to feedback from people who had actually run the exercises. Quick-reference one-pagers provide printable single-page guides for use during the exercise itself, which is a small change with a large effect on how usable a methodology is at 09:00 on the day. The documentation was reorganised, errors fixed and navigation improved. Scope widened to cloud environments, identity providers and modern infrastructure, and AI and machine learning threats were added through MITRE ATLAS and the OWASP LLM Top 10. Detection engineering coverage was expanded to include Detection-as-Code, Sigma rules, CI/CD deployment of detections and the detection lifecycle, and the framework was realigned to ATT&CK v18 with the updated Detection Strategies and Analytics terminology. ## The wider tool ecosystem it points at The framework references an ecosystem of tools rather than shipping one, and the v4 list names them. SCYTHE itself, MITRE Caldera, Atomic Red Team and The C2 Matrix appear as the broadened tool set, and continuous purple teaming is a named area with automated regression testing, breach and attack simulation integration and validation metrics. Remote and hybrid exercise logistics also got detailed guidance in v4, which is the kind of thing that only matters once someone has run an exercise with people in different time zones and had to work out the answer. The tool list is a pointer, not an endorsement, and the important structural point is where the framework stops. It defines the process, the roles, the sequencing and the measures, and it leaves the execution to the tools the participants already have. A company that runs Caldera internally and a company that runs SCYTHE can both follow the same exercise plan. ## The structure of the full framework document The complete methodology lives in `PTEFv4.md` and is also published as `PTEFv4.pdf`, and the table of contents is the clearest statement of what a purple team exercise involves. It starts with an executive summary and definitions, then goals and objectives, then industry and regulatory frameworks, then roles and responsibilities, then the planning phases, then the Cyber Threat Intelligence process, then the exercise execution flow, then lessons learned. Two entries stand out for anyone adopting the framework. The first is the Purple Team Maturity Model, the PTMM, which appears both in the main document and as its own poster one-pager, and which gives a way to describe where an organisation currently is. The second is the FAQ, which in a methodology document of this kind is usually where the awkward questions live. ## The one-pagers you hold during the exercise The `one-pagers/` folder is the part practitioners use in the room, and each guide has a markdown source and a PDF. The Exercise Checklist carries pre, during and post exercise checkboxes, which is the document that keeps a two day exercise from losing half a day to unrecorded decisions. The Roles Reference is a quick lookup for each role's responsibilities. The CTI Process one-pager lays out a seven-step flow with the key questions to ask at each step, which is a useful way to see whether the threat intelligence that started the exercise is specific enough to drive the whole day. Exercise Day provides a flow diagram with red and blue coordination, the Metrics Guide covers what to measure with tracking templates, and the PTMM Poster is the visual version of the maturity model with its levels. ## Templates, emulation plans and the version archive The `templates/` folder holds three artifacts for running an exercise. The Purple Team Exercise Template is a `.docx`, the TTP Mapping Template is an `.xlsx` spreadsheet, and the Emulation Plan Template is markdown. The mapping spreadsheet is the interesting one, because mapping TTPs is the step where a purple team exercise either becomes concrete or turns into a conversation about intentions, and a spreadsheet is a reasonable instrument for it. There is also an `emulation-plans/` directory at the repository root, and an `Archive/` folder that holds older files. The version history table in the README keeps every generation available in both markdown and PDF, with v1 described as the original version for internal enterprise teams, v2 as expanded for third-party providers such as consultants and managed service providers, v3 as the version that added operationalized purple teaming and dedicated purple teams, and v4 as the current practitioner usability overhaul. That history explains the structure of the repository as much as the framework does. ## MIT licensed, with the caveat that this is a snapshot The licence is MIT, and the README points to the LICENSE file for the details, with a contributor guide in `CONTRIBUTING.md` covering how to submit pull requests, report issues and suggest improvements. The v4 change list also mentions contributor guidelines as a deliberate addition, which says something about how the project expects to change. Two caveats are worth stating plainly. First, there are no GitHub releases, so the versions in the README are file names in the repository rather than tagged artefacts, and the last push was on 2026-04-09, several months before this writing. If your organisation's audit trail needs a dated, signed copy of the methodology, take the PDF and version it yourself, because the repository does not freeze versions for you. Second, the framework carries the authors' judgement about what good practice looks like, and its authority comes from adoption rather than from a standards body, so aligning your own detection engineering programme to it is a decision rather than a compliance step. ## Conclusion Adopt PTEF when your organisation already runs red and blue team work together and needs a documented process, since the framework gives you the planning phases, the CTI flow, the exercise day coordination and the maturity model in a form you can hand to participants. Do not adopt it expecting tooling, because the repository is documents, templates and PDFs rather than an automation platform, and the tooling it references, such as SCYTHE, MITRE Caldera, Atomic Red Team and The C2 Matrix, lives elsewhere. Verify first which version you need, because the repository carries v1 through v4 side by side with an Archive folder, and note that the last push was on 2026-04-09, so the document you read is a snapshot rather than a live one. ## FAQ ### What is the Purple Team Exercise Framework? It is a methodology from SCYTHE for designing and executing collaborative security exercises that bring together Cyber Threat Intelligence, Red Teams and Blue Teams, covering planning, the CTI process, exercise execution, lessons learned and a maturity model, in markdown and PDF. ### What is the difference between the three purple team models in PTEF? Purple Team Exercises are ad-hoc collaborative exercises, an Operationalized Purple Team is a continuous virtual team effort, and a Dedicated Purple Team means dedicated staff roles inside the organisation. ### Which documents can I print and use during an exercise? The `one-pagers/` folder holds six printable guides with markdown sources and PDFs: the Exercise Checklist, the Roles Reference, the CTI Process, Exercise Day, the Metrics Guide and the PTMM Poster. ### Which version of PTEF should I use? v4 is the current version, a practitioner usability overhaul with one-pagers, cloud and identity coverage, AI and ML threat guidance and ATT&CK v18 alignment. Earlier versions v1, v2 and v3 are kept in the repository, and the Archive folder holds older files, so the repository does not freeze versions for you. ## Sources - [Issues](https://github.com/scythe-io/purple-team-exercise-framework/issues) - [License: MIT](https://github.com/scythe-io/purple-team-exercise-framework/blob/master/LICENSE) - [Project website](https://scythe.io) - [README](https://github.com/scythe-io/purple-team-exercise-framework/blob/master/README.md) - [scythe-io/purple-team-exercise-framework on GitHub](https://github.com/scythe-io/purple-team-exercise-framework) --- Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/scythe-io-purple-team-exercise-framework