Adversary Simulation: What It Is and How It Differs from Red Teaming

Your SOC has detection rules. Your EDR is deployed across every endpoint. Your SIEM correlates events from 40 data sources. Your firewall policies follow best practices. But can your security stack actually detect and stop the specific threat actors targeting your industry?

Adversary simulation answers that question. Rather than testing broadly for vulnerabilities (that's penetration testing) or simulating a motivated attacker over weeks (that's red teaming), adversary simulation replicates the exact tactics, techniques, and procedures (TTPs) of known threat groups against your environment to measure whether your defenses detect and prevent them.

The distinction matters because US enterprises face specific, documented threat actors. Financial institutions face FIN7 and Carbanak. Healthcare faces APT41 and Lazarus. Critical infrastructure faces Sandworm and Volt Typhoon. Adversary simulation takes these known playbooks and runs them against your defenses, producing a gap analysis showing exactly which attack steps your security stack detects, which it blocks, and which pass through unnoticed.

This guide covers what adversary simulation is, how it works, the MITRE ATT&CK framework that underpins it, how it differs from red teaming and penetration testing, when US enterprises should use it, and how it integrates into a comprehensive offensive security programme.

What Is Adversary Simulation?

Adversary simulation is the controlled execution of real-world threat actor TTPs against an organization's environment to evaluate whether security controls detect and prevent specific attack techniques. The simulation follows documented attack playbooks mapped to MITRE ATT&CK, producing a measurable detection coverage assessment.

How It Differs from Generic Security Testing

Adversary simulation doesn't look for vulnerabilities. It doesn't try to "break in" through any available path. It takes a specific threat actor's known attack chain and executes it step by step: their initial access technique, their persistence mechanism, their lateral movement method, their data exfiltration approach. At each step, the simulation measures whether your detection and prevention controls fire.

The MITRE ATT&CK Foundation

MITRE ATT&CK is the knowledge base that makes adversary simulation possible. It catalogues the tactics (what attackers are trying to achieve) and techniques (how they achieve it) observed in real-world intrusions, organized by threat group.

14 ATT&CK Tactics: Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact.

Hundreds of Techniques: Each tactic contains multiple techniques (how the goal is achieved) and sub-techniques (specific implementations). For example, under Persistence: registry run keys, scheduled tasks, boot or logon scripts, implant container images.

Threat Group Profiles: ATT&CK maps specific techniques to known threat groups. APT29 (Cozy Bear) uses spearphishing attachments (T1566.001), PowerShell execution (T1059.001), token manipulation (T1134), and encrypted C2 channels (T1573). Adversary simulation executes this exact chain.

How Adversary Simulation Works

Phase 1: Threat Intelligence and Scenario Selection

Identify which threat actors target your industry, geography, and organization type. For US enterprises, this includes nation-state actors (APT groups targeting specific sectors), financially motivated groups (ransomware operators, FIN groups), and emerging threat patterns from CISA advisories and sector-specific ISACs.

Selection criteria: Which threat groups target your industry? Which groups have the capabilities to affect your organization? Which attack techniques does your current security stack claim to detect? What are the highest-consequence attack scenarios for your business?

Phase 2: Attack Chain Construction

Build the simulation plan mapping specific ATT&CK techniques to each phase of the selected threat actor's kill chain.

Example: FIN7 simulation for a US financial institution

Phase 3: Controlled Execution

Execute each technique in the attack chain against the production environment (or a representative staging environment). At each step, record whether the technique succeeded, whether detection fired, what alert was generated, and how long detection took.

Critical constraint: Adversary simulation is controlled and coordinated. Unlike red teaming where the goal is to avoid detection, adversary simulation wants to measure detection. The SOC may or may not be informed depending on the exercise type.

Phase 4: Detection Gap Analysis

Map execution results against your detection capabilities.

This gap analysis tells you exactly where your defenses work and where they fail against the specific threat you face.

Phase 5: Remediation and Re-Testing

For each gap, recommend specific detection improvements: new SIEM rules, EDR policy adjustments, network monitoring enhancements, or security architecture changes. After remediation, re-simulate to validate that the gap is closed.

Adversary Simulation vs Red Teaming

This is the most common confusion. Both involve offensive security professionals attacking your environment. The difference is purpose, scope, and methodology.

When to Use Adversary Simulation

You know which threat actors target you and want to validate your defenses against their specific techniques.

You want to measure and improve detection coverage with a quantifiable detection rate score (e.g., "we detect 73% of APT29 techniques").

You're building or tuning SIEM/EDR detection rules and need to test whether they fire against realistic attack techniques.

You want repeatable exercises to measure improvement over time. Run the same simulation quarterly and track detection rate improvement.

Regulatory requirements mandate threat-led testing. DORA's TLPT requirement and US sector-specific regulations. See our DORA guide.

When to Use Red Teaming

You want to test organizational resilience including people, process, and technology (not just detection tooling).

You want to know if a motivated attacker can achieve a specific objective (access the crown jewels, exfiltrate customer data, disrupt operations).

You want to test incident response under realistic conditions where the SOC doesn't know the exercise is happening.

Your security programme is mature enough to benefit from creative adversary simulation rather than structured technique testing.

See our red teaming vs penetration testing guide for the broader comparison.

Adversary Simulation vs Penetration Testing

Penetration testing and adversary simulation serve different purposes and should not be confused.

DimensionAdversary SimulationPenetration TestingGoalMeasure detection against known TTPsFind exploitable vulnerabilitiesFocusDefensive controls (detect/prevent)Offensive vulnerabilities (exploit)MethodologyReplicate specific threat actor techniquesTest for all vulnerability typesOutputDetection gap analysisVulnerability findings with PoCATT&CK mappingCore methodologyOptional enhancementWhat it testsSOC, SIEM, EDR, network monitoringApplications, infrastructure, configurations

Penetration testing answers: "What vulnerabilities exist?" See our penetration testing methodology.

Adversary simulation answers: "Can our defenses detect and stop this specific attack?"

Most US enterprises need both. Penetration testing identifies vulnerabilities to fix. Adversary simulation validates that detection and response work against real threats.

Adversary Simulation vs Breach and Attack Simulation (BAS)

BAS tools automate the execution of attack techniques against your environment. They're related to adversary simulation but differ in important ways.

DimensionAdversary Simulation (Expert-Led)BAS (Automated)ExecutionHuman operators adapting in real timeAutomated tool running predefined testsRealismRealistic operator behavior, timing, evasionSynthetic test patternsCustomizationTailored to your threat profileGeneric technique libraryDepthChains techniques into realistic campaignsTests techniques in isolationCostPeriodic engagementsContinuous platform subscriptionBest forValidating against specific threat actorsContinuous baseline coverage testing

Recommendation: Use BAS for continuous baseline detection validation. Use expert-led adversary simulation for deep, realistic threat-specific testing quarterly or semi-annually.

Adversary Simulation for US Enterprises

US-Specific Threat Landscape

US enterprises face a documented set of threat actors organized by sector.

Financial Services: FIN7, FIN12, Carbanak, Lazarus Group, APT38. Techniques: spearphishing, PowerShell, lateral movement through Active Directory, financial data exfiltration. Banking security requires simulation against these specific groups.

Healthcare: APT41, Lazarus, various ransomware operators. Techniques: supply chain compromise, credential harvesting, ePHI exfiltration, ransomware deployment. Healthcare security assessments should incorporate adversary simulation.

Critical Infrastructure: Sandworm, Volt Typhoon, XENOTIME. Techniques: living-off-the-land, OT network pivoting, long-dwell persistence. These groups operate with patience and stealth.

Technology: APT29, APT28, various Chinese APT groups. Techniques: supply chain attacks, cloud exploitation, source code theft.

Retail and E-Commerce: FIN6, FIN7, Magecart groups. Techniques: POS malware, web skimming, payment data exfiltration. E-commerce security benefits from simulation against card theft techniques.

US Regulatory Context

CISA guidance. CISA regularly publishes advisories identifying specific threat actors targeting US sectors. These advisories provide the threat intelligence that drives adversary simulation scenario selection.

SEC cybersecurity rules. Public companies must disclose material cybersecurity incidents. Adversary simulation provides evidence that the organization proactively tests defenses against documented threats.

Sector-specific regulations. Financial services (OCC, FFIEC guidelines), healthcare (HIPAA risk analysis), energy (NERC CIP), and defense (CMMC) all benefit from adversary simulation demonstrating defensive validation.

NIST framework alignment. Adversary simulation directly supports NIST CSF Detect (DE.CM, DE.AE) and Respond (RS.AN) functions.

DORA (for US firms with EU operations). DORA requires threat-led penetration testing (TLPT) for significant financial entities operating in the EU. Adversary simulation methodology directly supports TLPT requirements. See our DORA testing guide.

Purple Teaming: The Collaborative Variant

Purple teaming is adversary simulation conducted collaboratively between the offensive team (red) and the defensive team (blue). Rather than testing whether the SOC detects an attack, purple teaming works alongside the SOC to build and validate detections in real time.

How Purple Teaming Works

1. Red team executes a technique (e.g., LSASS credential dump)
2. Blue team observes whether detection fires
3. If no detection: blue team builds detection rule while red team explains the technique
4. Red team re-executes to validate the new detection
5. Move to next technique

When Purple Teaming Adds More Value Than Adversary Simulation

When detection coverage is low and you need to build detections, not just identify gaps. Purple teaming builds capability. Pure adversary simulation measures existing capability.

When SOC maturity is developing and the team benefits from working alongside offensive experts to understand attack techniques.

When budget is limited. Purple teaming is typically shorter than full adversary simulation because it combines testing and remediation into one phase.

Building an Adversary Simulation Programme

Maturity Progression

Level 1: Foundational. Start with penetration testing to identify vulnerabilities. Build basic detection capabilities. Deploy EDR and SIEM.

Level 2: Structured Testing. Conduct annual red team exercises to test organizational resilience. Begin threat modelling to identify priority threats.

Level 3: Threat-Informed Defense. Implement adversary simulation targeting specific threat actors relevant to your sector. Measure detection coverage against ATT&CK. Run purple team exercises to build detection capabilities.

Level 4: Continuous Validation. BAS tools provide continuous baseline testing. Quarterly expert-led adversary simulation validates against evolving threats. Detection coverage metrics tracked over time. Integration with CTEM for continuous threat exposure management.

Integration with Existing Security Programmes

Penetration testing finds vulnerabilities. Web application, API, cloud, network, and internal testing identify weaknesses that need fixing.

Adversary simulation validates defenses. After vulnerabilities are fixed, simulation confirms that your detection and response capabilities catch the attack techniques that would exploit similar weaknesses.

Threat hunting uses simulation findings. Detection gaps identified through simulation become hypotheses for threat hunting: "We can't detect DLL injection. Are there indicators in our environment that suggest it has already occurred?"

Attack surface management informs simulation scope. External asset discovery ensures simulation covers all entry points a real adversary would target.

Measuring Adversary Simulation Effectiveness

Detection Coverage Score

Percentage of simulated techniques that generated a detection alert.

Formula: (Techniques detected / Techniques executed) x 100

Target: 80%+ for critical threat actors. 60%+ for secondary threat actors. Below 50% indicates significant detection investment needed.

Mean Time to Detect (MTTD)

Average time between technique execution and alert generation. Faster is better. Track MTTD improvement across repeated simulations.

Prevention Rate

Percentage of simulated techniques that were automatically blocked (not just detected). Prevention is stronger than detection because it stops the attack without requiring human response.

Alert Fidelity

Percentage of alerts that correctly identify the technique. Low fidelity means the SOC receives alerts but can't determine what's happening, slowing response.

Coverage by ATT&CK Tactic

Track detection coverage across all 14 ATT&CK tactics. Many organizations have strong detection for Initial Access and Execution but weak detection for Lateral Movement and Defense Evasion.

How AppSecure Delivers Adversary Simulation

AppSecure provides adversary simulation through red teaming and offensive security testing services.

Threat Intelligence Driven. Simulation scenarios built from threat intelligence specific to your industry and geography. ATT&CK-mapped attack chains reflecting the threat actors that actually target your sector.

Complete Kill Chain Execution. Initial access through exfiltration. Every technique executed, measured, and documented. Detection gap analysis with specific remediation guidance.

Purple Team Capability. Collaborative exercises building detection alongside testing. SOC teams work with offensive operators to develop and validate detection rules in real time.

Multi-Layer Testing. Adversary simulation integrates with penetration testing for vulnerability discovery, manual testing for business logic validation, and continuous testing for ongoing security assurance. Application security assessment and PTaaS provide comprehensive coverage.

3-Week Delivery. 90-day remediation support. Complimentary retesting validating that detection gaps are closed.

Contact AppSecure:

• Schedule Adversary Simulation
• Red Teaming Services
• Offensive Security Testing

Frequently Asked Questions

1. What is adversary simulation?

Adversary simulation is the controlled execution of real-world threat actor TTPs against an organization's environment to evaluate whether security controls detect and prevent specific attack techniques. Simulations follow documented attack playbooks mapped to MITRE ATT&CK, producing measurable detection coverage assessments. Unlike penetration testing (which finds vulnerabilities) or red teaming (which tests holistic resilience), adversary simulation specifically measures whether your defenses work against the threat actors targeting your sector.

2. How does adversary simulation differ from red teaming?

Adversary simulation executes documented ATT&CK techniques systematically to measure detection coverage, often collaboratively with the SOC. Red teaming conducts creative, goal-oriented adversary campaigns where the SOC is unaware, testing holistic organizational resilience. Simulation produces detection gap matrices with coverage scores. Red teaming produces narrative campaign reports. Simulation is highly repeatable for measuring improvement over time. Red teaming is unique per engagement. Both are valuable at different maturity stages.

3. What is MITRE ATT&CK and why does it matter for adversary simulation?

MITRE ATT&CK is a knowledge base cataloguing tactics and techniques observed in real-world cyber intrusions. It organizes attack behaviors across 14 tactics (from Reconnaissance through Impact) with hundreds of specific techniques, mapped to known threat groups. ATT&CK enables adversary simulation by providing documented playbooks for specific threat actors: if APT29 uses techniques T1566, T1059, T1134, and T1573, adversary simulation executes those exact techniques and measures your detection against each.

4. When should a US enterprise use adversary simulation?

When you know which threat actors target your sector and want to validate defenses against their specific techniques. When you need measurable detection coverage scores for leadership reporting. When building or tuning SIEM and EDR detection rules. When regulatory requirements mandate threat-led testing (DORA TLPT, sector-specific guidance). When your security programme has matured past basic penetration testing and you need to validate that detection and response capabilities work.

5. What is the difference between adversary simulation and BAS?

BAS (Breach and Attack Simulation) tools automate attack technique execution continuously. Expert-led adversary simulation uses human operators who adapt in real time with realistic behavior. BAS tests techniques in isolation; adversary simulation chains them into realistic campaigns. BAS provides continuous baseline monitoring; adversary simulation provides deep, threat-specific validation. Most organizations benefit from BAS for continuous coverage and expert-led simulation for quarterly deep assessment.

6. What is purple teaming?

Purple teaming is adversary simulation conducted collaboratively between offensive (red) and defensive (blue) teams. The red team executes an attack technique, the blue team observes whether detection fires, and if not, they build detection together before moving to the next technique. Purple teaming builds detection capability during the exercise rather than just identifying gaps. It's most valuable when detection coverage is low and the SOC needs to develop capabilities.

7. How do you measure adversary simulation results?

Key metrics include detection coverage score (percentage of techniques that generated alerts), mean time to detect (speed from execution to alert), prevention rate (percentage automatically blocked), alert fidelity (accuracy of alert classification), and coverage by ATT&CK tactic (identifying weak areas across the kill chain). Track these metrics across repeated simulations to measure improvement over time.

8. Which threat actors should US financial institutions simulate?

US financial institutions should prioritize simulation against FIN7 (sophisticated financially motivated group targeting payment systems), FIN12 (ransomware deployment), APT38/Lazarus (North Korean state-sponsored, targeting financial theft), and Carbanak (banking-specific malware and techniques). CISA advisories and FS-ISAC intelligence provide current threat profiles. Simulation scenarios should match the techniques these groups currently use.

9. How often should adversary simulation be conducted?

Quarterly for organizations facing high-threat environments (financial services, critical infrastructure, defense). Semi-annually for enterprises with moderate threat profiles. After significant security architecture changes (new EDR deployment, SIEM migration, network redesign). After threat intelligence indicates new techniques from threat actors targeting your sector. BAS tools should run continuously between expert-led simulation exercises.

10. Does adversary simulation replace penetration testing?

No. They serve different purposes. Penetration testing identifies exploitable vulnerabilities in your applications and infrastructure. Adversary simulation validates whether your detection and response capabilities catch specific attack techniques. You need penetration testing to find and fix vulnerabilities. You need adversary simulation to confirm your defenses detect attacks that exploit similar vulnerability classes. Most mature security programmes run both.