Home / Knowledge hub / Breach and attack simulation
Knowledge hub
Breach and attack simulation
Software that repeatedly plays known attacker steps to test your defences.
What it means
Breach and attack simulation, often shortened to BAS, is software that safely replays known attacker techniques against your environment to see whether your defences notice and stop them. It runs on a schedule or on demand, and reports which steps were blocked, detected or missed. It was built for security teams that already own detection tools.
Its scripts are usually based on catalogues such as MITRE ATT&CK. The question it answers is whether your existing controls work, such as your email filter, endpoint tools and alerting. It is a measure of control effectiveness, not a search for new vulnerabilities.
Why it matters
Security tools are bought and configured, then rarely tested. A rule may have been switched off, an agent may be missing from a new server, or an alert may go to a mailbox nobody reads. Simulation finds these quiet failures before an attacker does. A control that exists on paper but does not fire is the typical finding.
Repeatability is the strength. Run the same set every week and you see the trend, and you notice when a change breaks a control. It supports teams building a purple team practice, where defenders and testers improve detection together. It also gives security teams evidence for budget conversations.
How it shows up
You meet it as agents or virtual machines placed inside the network that act out techniques such as phishing delivery, credential theft or data transfer, then check what your tools did. It mainly tests detection and response in the environment around your application.
Mistakes: expecting it to find flaws in your own application code, treating a high block rate as proof of safety, and running it without telling the operations team. It checks defences, not application logic, so it does not replace web application pentesting.
Questions people ask
Breach and attack simulation, answered
Is BAS the same as a penetration test?
No. A pentest looks for weaknesses and exploits them to prove impact. BAS replays known techniques to check whether defences notice them.
One tests how things can be broken, the other whether the alarms work.
Does it find vulnerabilities in my application?
Generally not. It tests security controls such as email filters, endpoint tools and network monitoring, using known techniques.
Application flaws need application-level testing. Use pentesting for that.
Is it safe to run?
The techniques are designed to be non-destructive, but they still touch real systems. Agree the scope, tell the people who watch alerts and start in a limited area.
Check what each scenario does before enabling it. Test in a limited area first.
Who benefits most from BAS?
Organisations that already run detection tools and a monitoring team, and want to know whether those tools work.
Small teams with no monitoring gain more from basic fixes first.
How does it relate to MITRE ATT&CK?
ATT&CK is a public catalogue of attacker techniques. Simulation tools use it to organise scenarios and to show which techniques you can detect.
Coverage against it is a useful, but not complete, measure.
Sources
Where this comes from
Related
Terms that sit next to this one
MITRE ATT&CK
A public catalogue of the tactics and techniques real attackers use.
Purple team
Attackers and defenders working together so each test improves detection.
Red team
A simulated adversary given a goal and left to reach it however they can.
Penetration test
A time-boxed engagement where skilled people attack your systems by hand.
Threat hunting
Searching your systems for attackers that alerts have not yet caught.
Do your alarms ring when they should?
Simulation checks your defences. We find vulnerabilities in web apps and their APIs and report only what we actually exploited. Ask us to run it on one of your applications.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.