Evidence, rules, artifact
Purple output is a replayable chain — artifacts, rule packs, and test.fire receipts hashed so another operator gets the same verdict.
Evidence hashing contract
Run techniques,collect hashed evidence.
Score detection, and ship reports. Download the desktop console or manage runs from the cloud dashboard. Same contracts, same hashed artifacts.
Built for purple teams who ship evidence
Guards before execution
Runs stop before noise reaches your SIEM. Scope, inventory, and snapshot checks exit with a fixed code when anything is ambiguous.
Scope & network guards
Desktop + cloud
Same contracts and hashes on desktop or in cloud — offline critical path, optional sync without changing rule or artifact contracts.
Desktop console
Deliverables every campaign exports
Rule change, measured
Measure what changed when rules land on real artifacts — miss-to-hit deltas on the same hashed evidence.
Compare detect-score runs
Campaign reports
Every campaign ships report.md with metadata, coverage, and source hashes stakeholders can replay byte-for-byte.
report.md schema
OSINT with receipts
Report intel stays tied to hashed snapshots — receipts anchor what the run knew even if sources move.
Source hash binding
Ready to replay your first campaign?
Start on desktop with synthetic fixtures, then upgrade for cloud sync, exports, and team workspaces.
Articles
View allLLM Mixers and Agent Frameworks: When Aggregation Itself Is the Attack Surface
Google's new LLMjacking research describes an underground resale tier that aggregates stolen enterprise AI access and rents it out, while a separate report ties an open-source multi-agent framework to automated attacks on 200-plus organisations. Both cases put the aggregation layer — not the model or the exploit — at the centre of the intrusion.
Read →
Supermarket freezers, NAS boxes and a poisoned update channel: the exposed management plane
A second wave of attacks on European supermarket refrigeration controls, C3RB3R ransomware on outdated Synology DSM builds and a hijacked cPGuard update channel share one property: everything the attacker needed was reachable, stale, or trusted by default.
Read →
Europe's Fridge Attacks Show the Cost of Internet-Exposed Controllers
A second wave of refrigeration attacks hit supermarkets across at least nine European countries, while attackers are also actively exploiting a 10.0-rated Siemens IoT gateway flaw and pushing C3RB3R ransomware onto outdated Synology NAS devices. The common thread is unmanaged, internet-reachable management interfaces.
Read →Europe's Freezer Attacks and the NAS Ransomware Wave Share One Root Cause
A second wave of attacks on supermarket refrigeration controllers hit at least ten European countries, while Synology battles C3RB3R ransomware on outdated NAS firmware. Both campaigns succeeded where internet exposure, default credentials and end-of-life firmware met thin telemetry.
Read →
Same Failure Mode, Three Victims: Internet-Exposed OT, Unpatched Firmware, and a Ransomware Crew
A second wave of refrigeration attacks hit European supermarkets, Siemens confirmed active exploitation of a CVSS 10.0 Node-RED flaw, and C3RB3R is encrypting Synology NAS boxes via a 2024 patch gap. All three trace back to internet-reachable devices running firmware nobody owns anymore.
Read →ENISA 2026: ransomware still pays—and supply chains multiply blast radius
ENISA’s 2026 landscape: financially motivated activity, ransomware, and supply-chain blast radius—with concrete purple scenarios for European operators.
Read →