For more than 10 years, Charles Garrett has worked close to the machinery of cybersecurity, where alerts arrive faster than analysts can process them, cloud environments introduce new complexity, and sophisticated tools leave gaps between detection and action. That experience now informs the expansion of Purple Shell Security, a security operations engineering firm built around a practical question: How can organizations get more from technology already in place?
Garrett brings more than 13 years of experience spanning security operations, managed security services, financial services, cloud defense, detection engineering, and automation, including cloud cyber defense at Citi. That background shapes a company that does not begin with another platform. Purple Shell Security starts with the work itself, identifying where investigations slow down, where analysts repeatedly gather information, and where disconnected systems create friction.
“Security teams already have powerful technology,” Garrett states. “The opportunity is often in the workflow between those systems. When analysts repeatedly collect the same context, move between tools, or perform the same investigative steps, that is work that can be engineered.”
Purple Shell Security works across detection engineering, workflow automation, systems integration, and AI-assisted investigation, helping organizations improve how existing SIEM, endpoint, cloud, identity, and automation technologies function together.
Garrett’s practitioner background is also visible in public projects centered on building, testing, and validation. Pylon assesses Microsoft Sentinel detection coverage and proposes KQL detections and incident-response playbooks. GuardDutyTriageAgent uses Amazon Bedrock and read-only tools to triage AWS findings before forwarding results to a SIEM. AdversaryLab applies a similar discipline to detection engineering by generating adversarial behavior, observing telemetry, developing detections, and reproducing activity to validate the result.
That emphasis on validation carries directly into Purple Shell Security’s work. A detection is not simply deployed; coverage, tuning, and failure modes matter. An automated workflow is not finished merely because systems can exchange data; evidence, decision points, and human approvals must work in practice.
Artificial intelligence is approached with the same discipline. Predictable activities, including evidence retrieval, security-platform queries, and resource-context collection, can be handled through APIs, rules, and orchestration. AI can then be introduced when reasoning, synthesis, or contextual analysis can improve an investigation. In an identity-related incident, automation can gather sign-in activity, identity records, endpoint signals, security events, and threat intelligence, while AI organizes the evidence for analyst review.
“The objective is not to add AI for the sake of adding AI,” Garrett shares. “It is to understand what the workflow needs to accomplish, automate what should be predictable, and use AI where it improves the result.”
The approach reflects a broader challenge. Technology alone does not determine operational effectiveness. Integration, workflow design, testing, and human judgment determine whether technology translates into better decisions. The firm addresses detection gaps, builds production-ready detections, automates investigation steps, strengthens integrations, and keeps security capabilities useful after deployment.
Garrett founded the company around a direct model. Clients work with the engineer responsible for understanding the problem and building the solution, rather than moving through layers of account management and large implementation teams. That structure reflects a career grounded in production security operations, cloud defense, investigation, automation, and detection engineering.
At a time when cybersecurity conversations often gravitate toward the newest platform or AI capability, Garrett’s approach places attention on something fundamental: the connective tissue between tools, evidence, analysts, and action. Purple Shell Security is built to strengthen that connective tissue, reducing repetitive work while making security operations more consistent. The expansion is rooted in a practitioner’s conviction that security improves when what can be engineered is engineered, what can fail is tested, and human expertise is reserved for decisions where it matters most.
