One command can stand up an entire fictional company, a full open-source SOC and AI agents that play both sides.
Most security teams want to understand how AI agents will change attack and defense. Very few have a safe place to test that without risking production systems.
APTL, the Advanced Purple Team Lab, is an open-source answer. It gives practitioners a realistic environment where agents can run exercises against a simulated enterprise and its defenses.
In the SecTor 2026 talk "Practical Open Source Agentic Purple Teaming", on Thursday, October 8 at 10:15 a.m. in Room 801A, Brad Edwards walks through what the lab can do today and how practitioners can use it.
Speaker: Brad Edwards, Domain Consultant, SecOps Transformation, Palo Alto Networks
The lab deploys a fictional company with Active Directory, web, database, file share, DNS and mail systems. The defensive side is a SOC stack built from Wazuh, Suricata, MISP, TheHive with Cortex and Shuffle.
MCP servers give AI agents programmatic access to each layer. That lets a single agent query alerts, correlate indicators, trigger containment workflows and triage cases.
The project is MIT-licensed and openly labeled as under active development, not hardened for production use. That makes it a learning and research environment rather than a deployable product.
Brad Edwards is a domain consultant for SecOps transformation at Palo Alto Networks, based in Vancouver. Before moving into security operations, Edwards spent 15 years as an RCMP constable working in digital forensics and economic crime.
Edwards later worked as an enterprise software developer and led the British Columbia Lottery Corporation's SecOps program. Edwards's research focuses on autonomous security operations and the everyday threats most likely to hit organizations.
The APTL repository has the lab and setup instructions. Edwards also gave a live demo of the lab at NorthSec.
SOC teams, detection engineers and anyone who wants hands-on experience with agent-driven defense will find a ready-made place to practice.
Would you trust an AI agent to triage and contain incidents in your SOC, or only to assist a human analyst?
Source: r/pwnhub · by /u/_cybersecurity_