## Metrics & Reporting

How do you prove Purple Teaming works?

### The Scorecard
*   **Detection Rate**: "We detected 5/10 attacks (50%)." -> "Next month: 8/10 (80%)."
*   **Data Quality**: "We had logs for 9/10 attacks, but no rule."
*   **Alert Fidelity**: "We had an alert, but it was classified as 'Info' instead of 'Critical'."

### The Executive Report
"We simulated a Ransomware attack.
*   Result: We successfully blocked execution.
*   Gap: It took us 4 hours to detect the initial phishing email.
*   Plan: Tune email gateway filter."

This creates a dashboard of **Continuous Improvement**.