Detections decay.
Quietly.
A rule that fired perfectly in March can be dead by September because a field name changed, a log source stopped arriving or somebody tuned the noise out of it. Nothing tells you. Running the attack again does.
The same attacks,
run again and again.
Breach and attack simulation is the safe, repeated execution of known attacker techniques against your live estate, specifically to check that the things meant to catch them still do.
A penetration test asks what an attacker could do. A purple team asks what your monitoring sees today. This asks a narrower question with a longer time horizon: is the detection you built six months ago still working, and can you prove it without waiting for a real incident to find out.
The techniques are agreed in advance, executed safely against agreed targets, and the result is read against your monitoring rather than left as a score in a dashboard. What comes out is a short list: what still fires, what has gone quiet since last time, and what was never covered.
- Techniques mapped to MITRE ATT&CK and chosen from your threat profile.
- Executed safely against agreed targets, in windows you control.
- Measured against your actual monitoring, not against a vendor score.
- Repeated on a cycle, so the output is a trend rather than a snapshot.
- Regressions surfaced as findings, with the detections rebuilt.
Nobody tells you
when a detection dies.
Detection content is the only part of a security estate that can fail completely and silently. A broken firewall rule breaks something visible. A dead detection just stops producing alerts, which looks exactly like a quiet week.
The causes are mundane, which is why they go unnoticed. A vendor renames a field in a schema update and a query that depended on it returns nothing. A log source is switched off during a migration and nobody maps it to the twelve rules that used it. A rule generates false positives for a fortnight, gets tuned, and the tuning is slightly too broad. A licence tier changes and a table stops being populated.
None of those produce an error. All of them produce silence, and silence is indistinguishable from safety until something real happens. Re-running the attack is the only way to tell the difference, and doing it on a cycle turns coverage from an assumption into a measurement.
- Schema and product change
- Vendors rename fields, deprecate tables and change event formats. Queries written against the old shape return nothing and report nothing.
- Tuning that went too far
- The most common cause by a distance. A rule is tuned to stop the noise and quietly stops catching the thing it was written for.
- Sources that stopped arriving
- A connector fails, an agent is uninstalled with a decommissioned server, a licence tier changes. Coverage disappears with no alert attached.
- Estate drift
- New systems, new identities, a migration. Detections written for what existed last year do not automatically cover what exists now.
A regression found this way costs an afternoon. The same regression found during an incident costs considerably more than that.
Baseline, repeat,
compare, fix.
The first run is a baseline and is useful on its own. The value compounds from the second run onwards, which is when it starts measuring movement.
-
01
Agree the scope
Which techniques, which targets, which windows, and what is explicitly out. Written down before anything executes, the same as any offensive engagement.
-
02
Baseline it
The first pass, establishing what is detected, what is noisy and what is invisible today. This is the reference every later run is measured against.
-
03
Close the gaps
Detections written and backtested for what was missed, tuning for what fired but drowned. The fix is part of the service rather than a recommendation.
-
04
Repeat on a cycle
Monthly or quarterly depending on how fast your estate changes. Each run is compared against the baseline rather than read in isolation.
-
05
Report the movement
What improved, what regressed and why, mapped to MITRE ATT&CK. A regression is a finding, not a footnote.
Attack simulation, answered.
What is breach and attack simulation?
The safe, repeated execution of known attacker techniques against your live estate to check that the controls and detections meant to catch them still do. The point is repetition: one run is a snapshot, a cycle of runs is a measurement.
How is it different from a penetration test?
A penetration test asks what an attacker could achieve and is run by people chasing an objective. This asks whether specific known techniques are still detected, is narrower, and is repeated on a cycle. They answer different questions and neither replaces the other.
How is it different from a purple team?
A purple team is a facilitated exercise over a couple of days with your defenders in the room, and it is how you build detection. This is how you find out it is still working six months later. Most organisations do the purple team first.
Is it safe to run against production?
Techniques are agreed in advance, executed against agreed targets in windows you control, and anything carrying real operational risk is simulated rather than executed. The rules of engagement are written down before anything runs.
How often should it run?
Monthly or quarterly for most organisations, and sooner after anything that changes the estate materially — a migration, a platform change, an acquisition. The cadence should track how fast things change rather than a calendar convention.
What happens when something regresses?
It is raised as a finding with what changed and when, and the detection is rebuilt and backtested. Fixing it is part of the service rather than a recommendation attached to a report, which is the difference between this and a scoring dashboard.
Do we need you to run our SOC?
No. The simulation and the findings stand on their own. Rebuilding what regressed is materially faster where we already run your detection content, and we will be clear about which version you are buying.
The first run is a baseline
and it is useful on its own.
It tells you what is detected, what is noisy and what is invisible today. Everything after that measures movement against it.