Breach and Attack Simulation (BAS) is an automated way to test security controls by safely replaying known adversary techniques, mapped to frameworks like MITRE ATT&CK, against a live environment and measuring the result. It answers whether prevention controls block each technique and whether monitoring logs and alerts on it. BAS is one capability within adversarial exposure validation. It is broader and more repeatable than a point-in-time test but narrower than full attack path validation, because it replays individual techniques rather than always chaining them into a complete intrusion.
What is breach and attack simulation, really?
Breach and Attack Simulation (BAS) safely runs known attacker techniques against your live environment on a repeating basis, then reports what your controls actually did. Each technique is mapped to a recognized framework, most often MITRE ATT&CK, so results are consistent and comparable over time.
For every technique, BAS records two things: did the prevention control block it, and did your monitoring capture and alert on it. The output is a measured picture of control effectiveness rather than a checklist of installed tools.
How does BAS work?
A BAS run follows a simple, safe loop:
- Select techniques. Choose the ATT&CK techniques relevant to your threat model, for example credential dumping, lateral movement, or data exfiltration.
- Execute safely. Run each technique in a controlled way that emulates the behavior without causing real damage.
- Measure prevention. Record whether the endpoint, network, or email control stopped it.
- Measure detection. Record whether the activity reached the SIEM and produced a real alert, not just a buried log line.
- Repeat. Because controls drift and content updates, the value comes from running it continuously, not once.
What does BAS prove?
A healthy BAS program surfaces problems a vulnerability scan never will:
- Prevention gaps. Techniques that pass straight through controls you assumed were blocking them.
- Detection gaps. Behavior that is logged but never triggers an alert, the difference between visibility and actual detection.
- Control drift. Protections that worked at deployment and quietly stopped working after an update or config change.
- Coverage over time. A trend line of how effectiveness changes, so regressions are caught early.
How do you get started with BAS?
Begin with the techniques most used against your sector rather than trying to cover all of ATT&CK at once. Validate both prevention and detection for each, fix what fails, and re-run to confirm the fix held.
BAS can run through in-house tooling or a continuous automated validation platform. Pair it with periodic human penetration testing so you get both the repeatable measurement of BAS and the creativity of a skilled tester.
References
- [1]MITRE ATT&CK Framework(MITRE)
- [2]MITRE ATT&CK Techniques(MITRE)
- [3]NIST SP 800-115 Technical Guide to Information Security Testing(NIST)