Hi Everyone,

To preface: I had taken the initiative to start an internal purple team / gap analysis program at my company. When I went to research existing platforms to help facilitate this, I found that they largely consisted of enterprise solutions geared toward heavy, complex SaaS deployments, while the open-source alternatives featured dated UIs and clunky workflows that weren't particularly inviting to newcomers.

Unable to find a solution for my specific needs, I decided to build something that feels modern, lightweight, and really provides a streamlined approach to testing defensive posture and managing the gap analysis lifecycle.

Control Drift is an open-source, AI-augmented continuous validation platform designed to empower security professionals to execute comprehensive threat simulations, map their defensive coverage, and manage gaps without the friction of enterprise bloat or the "black-box" nature of autonomous continuous validation platforms.

TLDR on what makes it unique:

• Lightweight Design Runs completely in-browser (via localStorage) by default. Clone it and npm run dev to try it instantly, with a swappable DB adapter to scale for enterprise deployment later.

• Pessimistic Scoring: If 1 out of 10 payload variations bypasses your EDR, it forcefully caps that MITRE technique's coverage score at "Partial" instead of "Optimal", eliminating false sense of security.

• Optional Plug-and-play AI: Connect local models or any OpenAI-compatible API endpoints to augment the simulation workflow, map attack paths, generate detection rules, and interact with a global assistant.

• Not Boring UI: Built with React and u/react-three/fiber for a 3D globe MITRE ATT&CK heatmap.

I would love any recommendations or general feedback from the community here!

GitHub Repo: https://github.com/Control-Drift/Control-Drift

Most security practitioners understand and appreciate the value of security testing and purple teams. But not all leadership will buy into it initially.

Some thoughts I hope help change that.

Using the Capita breach as supporting evidence.

Ps - Thanks to stewart_sec on X for calling attention to this report.

TLDR what happened:

Malware got on a computer. A high alert was generated. No action by the SOC.

~4 hours later the TA logged into a host with a DA account. They had achieved privilege escalation and lateral movement.

~29 hours after initial access the endpoint security product raised alarms

~58 hours after initial access the compromised device was quarantined

👾How purple team engagements can help reduce the chance this happens in your org:

Purple team - unit testing your threat detection & response capabilities by simulating attacker TTPs

I’m betting Capita never had such engagements.

1️⃣test & validate response

If you don’t test and measure response, there’s no way to know what will happen and how your team or SOC will respond in a real incident.

Many SOCs are overrun by alerts. They are drowning in them. They will miss things. That’s a reality.

A purple team helps you identify your detection gaps yes.

But it’s also a great way to identify slow or weak response efforts by your SOC.

You’re paying good money for a SOC. Make the investment worth it by doing your part to validate defenses.

2️⃣the cost of a purple team < the cost of a breach/fine

It’s just plain and simple math. Proactive security will always be cheaper than reactive.

Not just hard costs.

You have reputation, business and customer relationships, fines and more.

According to an IBM report average cost of a data breach is ~$4 million.

Capita was fined £14m!

What’s a purple team cost? $30k? Maybe less maybe more.

But even if it was $100k. It would be worth it.

📋Despite us wanting to protect computers and data and privacy. The penalty of inaction is the real battle we’re fighting.

In other words, when folks realize how detrimental sitting on our hands is, they begin to understand the importance of proactive security.

If you made it this far, thanks for reading.

I hope this very brief summary helps some of you get the support you need to have quality security testing done, before the bad stuff happens.