Purple Team Playbook: Cloud, Kubernetes, and Linux Attack Paths

A series on real attack anatomy, mapped to OWASP, and turned into detection rules and defense-in-depth you can deploy. Every episode follows the same discipline: Red attacks, Blue detects, Purple defends.

Who it’s for: Security engineers, SREs, and platform teams who want to understand actual breach mechanics — MFA fatigue at Uber, SSRF at Capital One, SolarWinds and XZ Utils — not abstract threat models.

Format: Red (attack technique, attacker perspective) → Blue (what monitoring catches it, what it misses) → Purple (structural fix or defense-in-depth layer). OWASP mapping at the top of every post instead of a Framework Alignment table.

By EP13, you’ll have a repeatable process for running these same attack simulations against your own infrastructure, on a schedule.

Published Episodes

EP	Title
EP01	What Is Purple Team Security: Red + Blue = Better Defense
EP02	OWASP Top 10 Mapped to Cloud Infrastructure: Beyond Web Apps
EP03	Cloud Security Breaches 2020–2025: What Actually Got Exploited
EP04	Broken Access Control in AWS: From Misconfigured S3 to Admin
EP05	MFA Fatigue Attacks: How Uber Got Breached and How to Stop It
EP06	CI/CD Secrets Exposure: How Supply Chain Attacks Target Your Pipeline
EP07	SSRF to Cloud Metadata: How IMDSv1 Enabled the Capital One Breach
EP08	Kubernetes Container Escape: Attack Paths and eBPF Detection
EP09	Supply Chain Attacks: From SolarWinds to XZ Utils — Detection and Defense
EP10	Cloud Lateral Movement: Cross-Account IAM Role Chaining Explained
EP11	Detection Engineering with eBPF: Kernel-Level Visibility for Cloud Incidents
EP12	Cloud Incident Response Playbook: First 24 Hours After a Breach
EP13	Continuous Purple Team Testing: Attack Simulations for Your Own Infrastructure

Series complete — all 13 episodes published.

Start with EP01: What Is Purple Team Security →

Get new episodes in your inbox → subscribe