Skip to content
ENExplore Calculators

Purple Team Effectiveness Calculator

Measure purple team value: detections built per technique tested, gaps closed, time to new detection and coverage gained.

About Purple Team Effectiveness Calculator

A purple team is only worth its cost if findings become durable detections, so gap closure and re-validation carry more than half the weight. Speed matters because a gap known for three months is an unmitigated risk, and quality is scored explicitly because shipping noisy rules to close a gap on paper makes the SOC worse. The initial detection rate is reported separately: it measures the estate you started with, not the team's work. Red teams produce reports and blue teams produce alerts; the purple metric is the only one that tracks whether a finding actually changed what the SOC can see.

Formula

Purple Team Effectiveness

effectiveness = 0.30×gapClosure + 0.25×validation + 0.20×speed + 0.15×quality + 0.10×coverageGain, where gapClosure = detections shipped ÷ gaps found and speed = 100 − 3 × days to detection.

gapClosure
Share of identified gaps that produced a shipped detection
validation
Share of new detections proven by re-testing
speed
Penalty of three points per day from gap to shipped detection
quality
Share of new detections that did not introduce unacceptable noise

Worked example

With the default values below, Purple Team Effectiveness Calculator returns Purple Team Effectiveness of 69.0. Change any input above and every figure here is recalculated in your browser.

Inputs used

Techniques exercised in the cycleaccepts 1–5,000 techniques
60 techniques
Detected on the first attemptaccepts 0–5,000 techniques
22 techniques
Gaps identifiedaccepts 0–5,000 gaps
38 gaps
New or improved detections shippedaccepts 0–5,000 detections
26 detections
Detections re-tested and confirmedaccepts 0–5,000 detections
21 detections
Mean days from gap to shipped detectionaccepts 0.1–730 days
12 days
Cycle lengthaccepts 1–104 weeks
6 weeks
Detections that generated unacceptable noiseaccepts 0–5,000 detections
4 detections

Results

Purple Team Effectiveness
69.0 / 100
Initial Detection Rate
36.7%
Gap Closure Rate
68.4%
Validation Rate
80.8%
Coverage Gained This Cycle
28.3%
Detections Shipped per Week
4.33 per week
Programme Rating
C — Fair

Step by step

  1. 1Values used
  2. 2Purple Team Effectiveness
  3. 3Purple Team Effectiveness= 69.0 / 100
  4. 4Initial Detection Rate= 36.7
  5. 5Gap Closure Rate= 68.4
  6. 6Validation Rate= 80.8
  7. 7Coverage Gained This Cycle= 28.3
  8. 8Detections Shipped per Week= 4.33 per week

Assumptions and limits

  • The result is derived only from the 8 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Purple Team Effectiveness calculated?

effectiveness = 0.30×gapClosure + 0.25×validation + 0.20×speed + 0.15×quality + 0.10×coverageGain, where gapClosure = detections shipped ÷ gaps found and speed = 100 − 3 × days to detection. A purple team is only worth its cost if findings become durable detections, so gap closure and re-validation carry more than half the weight. Speed matters because a gap known for three months is an unmitigated risk, and quality is scored explicitly because shipping noisy rules to close a gap on paper makes the SOC worse. The initial detection rate is reported separately: it measures the estate you started with, not the team's work.

Why does Purple Team Effectiveness matter?

Red teams produce reports and blue teams produce alerts; the purple metric is the only one that tracks whether a finding actually changed what the SOC can see.

What values do I need to enter?

This calculator takes 8 inputs: Techniques exercised in the cycle, Detected on the first attempt, Gaps identified, New or improved detections shipped, Detections re-tested and confirmed, Mean days from gap to shipped detection, Cycle length, Detections that generated unacceptable noise. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Is a low initial detection rate a bad result?

No — it is the reason the exercise was worth running. A 37% first-run rate on realistic techniques is normal; what matters is whether the other 63% turned into validated detections before the next cycle.

Why penalise noisy detections?

Because a rule that fires two hundred times a day is switched off or ignored within a fortnight, which means the gap is still open while the metrics say it closed. Counting noise against the score keeps the number honest.

Related Calculators

Purple Team Effectiveness Calculator | Calcrivo