The question it answers
Breach and attack simulation runs safe versions of attacker techniques and records whether each was blocked, logged and alerted on. It answers whether your existing controls behave as you expect.
How it differs from a penetration test
A penetration test is a time-boxed exercise by people who adapt to what they find. Simulation is automated and repeatable, which makes it suited to checking that a fix held after a change. The two complement each other.
Before you run it
Agree the following with operations and the monitoring team.
- Scope: which systems and networks may be tested.
- Safety: what each technique does and how it is cleaned up.
- Visibility: how the SOC will recognise a test and still measure its response.
- Follow-up: where findings go and who owns the fix.