The Resilience Room — with Kev Marriott
🎧 Listen now to The Resilience Room
Ask most people how they ended up in cyber security and you'll get a story about a plan. Ask Kev Marriott and you'll get a story about happenstance.
Kev spent the best part of two decades at British Telecom. He started in sales, became a trainer and an NVQ assessor, then drifted toward IT incident management — keeping the network, the platform and bt.com live and reducing downtime wherever he could. There's a lot of crossover between network operations and security, and over the years that crossover pulled him in. He ended up running the incident, problem and change management team for BT, coordinating the response to large-scale cyber and physical security incidents across critical national infrastructure.
Which also meant owning the playbooks. And being the person on the end of the phone at four in the morning.
"You have the joy of being the person called out at four o'clock in the morning if something goes wrong, to make the decision of what do we do. Do we stand something up? Do we get the team together? Do we reach out to third parties?"
What turned the job into a passion was seeing the other end of it. Before moving into security, Kev answered calls from customers who had lost savings to fraud — people whose lives had been materially damaged by an attack somewhere upstream. That's the thing that stuck.
Key takeaways
- Purple teaming is a culture, not a headcount. Some mature organisations do appoint someone to lead it, but the value comes from collaboration between red and blue, not from an org chart change.
- The gap between compromise and exfiltration keeps shrinking. Triage windows that were comfortable a few years ago are already too slow.
- Shadow AI is shadow IT's successor — and it arrives with a much bigger data problem attached.
- Your supply chain's AI is now your problem too. Without data lineage, you can't answer whether your model has been poisoned.
- Governance and good hygiene haven't been replaced by AI. Identity and access management, critical asset lists and network topology matter more now, not less.
What purple teaming actually is
The mechanics are straightforward. A red team gets sign-off from the CISO to test a defined part of the estate, with a scope and a set of goals they don't stray outside. The blue team usually knows nothing about it — deliberately, so that when they do spot something, they respond as though it's a genuine attacker. Then, at some point, the red team is called in and the two sides sit down together.
That sit-down is the purple team engagement. And Kev's point is that it isn't a formality — it's where the baseline actually moves.
"Blue teams are incredible. But the attack team always has the first move advantage."
What surprised me in the conversation was how little of this is technical. Purple teaming is mostly a social and organisational problem: getting two groups who are structurally set against each other into a room, regularly, with a shared interest in the outcome.
Kev is honest about the friction. Red team engagements can run for weeks. If the blue team finally spots something on Christmas Eve and gets called out, that doesn't build warmth between departments. The answer isn't to remove the competition — it's to make it healthy.
"Competition drives things forward. Every time a red team is thwarted because the blue team has learned something, you'd hope the red team takes a bit of a front to that and goes, well, you blocked that, but now I'm going after this."
The real unlock is being able to ask why. When a red team makes an odd jump between network boxes, a blue team looking at the topology can be genuinely baffled by the choice. In a purple team environment, you can simply ask them. Sometimes the answer is "we were just sniffing around." But over time, those conversations shape which boxes you forensically capture first, and which you prioritise for review. That's a process improvement you can't buy.
Kev returns to curiosity repeatedly — it's the first thing he looks for when hiring. Not what someone already knows, but whether they'll keep asking why.
Shadow AI, and a timeline that keeps contracting
The industry never quite solved shadow IT. It improved, but it didn't go away. Now it has a successor.
Shadow AI is people bringing the tool they use at home into work because it's familiar — sitting outside your governance model, outside your guardrails, ingesting whatever gets pasted into it. The consequences run from GDPR exposure to unreleased financial results leaving the building.
"The cyber industry was built on 'never knowingly give your data anywhere else.' AI is almost the antithesis of that. It's very much, give us all your data, as much as you can."
That's the genuinely new thing, in Kev's view. We spent years building behaviours — don't click the link, don't trust the email from the CEO, don't hand over your data because someone asked. AI risks quietly reversing some of that progress.
Meanwhile the clock is running faster. Kev deliberately wouldn't quote specific numbers ("even by the time this podcast is launched, it would probably be out of date"), but the shape is clear: a triage window that a SOC might reasonably have taken half an hour over a few years ago is now too slow. They're in and out before you've opened the ticket.
Immersive's purple team work in this space is being built against MITRE ATLAS, showing both sides of the same attack — how you'd run it, and how you'd spot, mitigate and prevent it.
The same logic shows up in vulnerability management. Kev pointed to Mythos, Anthropic's AI system for autonomous vulnerability discovery, as a conversation-starter — and was careful to frame this as his own view rather than Immersive's. Whatever you make of the tool itself, the point stands: vulnerability management has historically been organised around zero-days, while proficient threat actors have long chained together lower-severity flaws to get in and back out again. If discovery is about to happen at machine speed, you need SLAs and processes for every vulnerability across software, firmware and hardware — not just the headline ones.
Everything old is load-bearing again
None of this works without the unglamorous stuff. Identity and access management, now for agents as well as humans. Critical asset lists. Knowing your topology and how data flows through it. Knowing who owns an application and how quickly it can be patched.
Then there's the supply chain. Assurance used to mean asking a vendor about their patching schedule and incident response process. Now you also need to know about their AI — because if you're exchanging data with them and you have no data lineage, you can't answer whether your model has been poisoned.
And there's the money. Kev raised a question I hadn't considered: where does the AI budget actually sit, and what happens if you've reduced headcount on the assumption AI covers it, then burn through your tokens? With providers shifting from subscriptions toward usage-based pricing, ROI and financial risk end up as the same conversation — which is exactly the kind of conversation that forces security, IT, finance and the board into the same room.
Which, as I put it slightly flippantly during the episode, is a rainbow team. Kev's verdict: unhelpful as a job title, but not wrong about where this is heading.
The belts on the wall
I couldn't let the episode end without asking about the row of martial arts belts behind Kev on camera. He trains in MMA three times a week — three and a half years in, and roughly nine months out from his black belt. He took it up later than most of the people he spars with.
It turned out to be the most useful analogy in the conversation.
Playbooks matter. You need them, and audits require them. But nobody woken at 4am is turning to page 47 to find their response. What carries you is experience, previous learnings, and muscle memory built through repetition — doing the same thing over and over, in slightly different ways, looking for the improvement each time.
"You idealise the playbook as a result of the muscle memory you build and the evidence you capture while performing the activities — rather than relying on the playbook to guide you when you hit that point."
It cuts both ways in a security team. Some people don't feel empowered to make a decision under pressure. Others feel a bit too empowered, and make calls they weren't authorised to make. Rehearsal is what calibrates that.
Kev's closing note on AI is a fair one to end on. He's not an AI sceptic — he's clear about how much good it can do, particularly in automating the laborious work so blue teams can actually go threat hunting or talk to a part of the business they never had time for.
"Understand the use cases. Get your basic principles in place, test it, assure it, secure it, and you're in a really good place. Until it all changes in a week."
Over to you: Kev argues the biggest barrier to purple teaming isn't tooling — it's getting red and blue in a room often enough to build trust. If you've tried it, what actually made the collaboration stick? And if you haven't, what's stopping you?
Listen to the full episode of The Resilience Room wherever you get your podcasts.
Community Manager