Color: Purple team.
What Is This Category?
Mix (10 tools)
- License: 4 open source · 6 proprietary
- Hosting: 4 self-hosted · 1 SaaS · 5 both
Breach & Attack Simulation (BAS) automates the question “if an attacker did X, would we catch it?”. Instead of one-shot pentests, BAS continuously runs ATT&CK-aligned techniques on production systems and feeds the results back into the SOC: a green/red grid across the ATT&CK matrix showing which TTPs are detected, which slip through, and which are blocked outright.
Distinct from neighbouring categories
- Vulnerability Management – VM finds exposures; BAS tests whether the defensive response would work
- Reconnaissance & Asset Discovery – recon maps assets; BAS exercises defences against assumed-compromise behaviour
- SOAR – SOAR runs response playbooks; BAS tests whether those playbooks fire when they should
- Offensive Frameworks (Exploit / C2) – offensive frameworks are operator-driven against engagement targets; BAS is automated / scheduled / vendor-curated content
About this data & disclaimer
The information on these pages was researched by a combination of human review and large language models. This catalogue serves as a reference for the resources, applications, devices, deployment payloads, and other components that the ResorsIT platform integrates, deploys, and manages. To suggest an addition or correction, please contact us. Prepared by Rhodium Systems Inc., author of the ResorsIT platform — a unified IT operations management platform for IT teams and MSPs that integrates a curated suite of open-source, commercial, and SaaS applications into a single system with shared identity, single sign-on, access control, and a common audit trail. This information is compiled on a best-effort basis: it may be incomplete, contain errors, and become out of date as tools, vendors, licences, and features change. Use this catalogue only as a starting point for your own research, and independently verify and review any tool carefully against your own requirements before relying on it.
Comparison
Capability Matrix
| Tool | ATT&CK Library | Continuous | Cloud-Side | Endpoint | Chained Attacks |
|---|---|---|---|---|---|
| MITRE Caldera | yes | partial | – | yes | yes (planner) |
| Atomic Red Team | yes | – | – | yes | – |
| Infection Monkey | partial | – | – | yes | yes (self-spread) |
| Stratus Red Team | yes | – | yes | – | partial |
| Cymulate | yes | yes | yes | yes | partial |
| SafeBreach | yes (30K) | yes | partial | yes | partial |
| AttackIQ | yes | yes | partial | yes | partial |
| Picus Security | yes | yes | partial | yes | partial |
| Pentera | yes | yes | – | yes | yes (chained-attack engine) |
| Cobalt Iceberg | yes | yes | yes | partial | – |
License Comparison
| Tool | License | OSI | Type |
|---|---|---|---|
| MITRE Caldera | Apache-2.0 | yes | OSS platform |
| Atomic Red Team | MIT | yes | OSS test library |
| Infection Monkey | GPL-3.0-only | yes | OSS breach simulator |
| Stratus Red Team | Apache-2.0 | yes | OSS cloud BAS |
| Cymulate | Proprietary | – | Commercial SaaS |
| SafeBreach | Proprietary | – | Commercial SaaS |
| AttackIQ | Proprietary | – | Commercial SaaS |
| Picus Security | Proprietary | – | Commercial SaaS |
| Pentera | Proprietary | – | Commercial SaaS |
| Cobalt Iceberg | Proprietary | – | Commercial SaaS |
Composition Patterns
1. OSS-only purple-team practice
MITRE Caldera -- orchestration platform
Atomic Red Team -- test-library content
Stratus Red Team -- cloud-side BAS for AWS / Azure / GCP
Infection Monkey -- holistic lateral-movement testing
+ SIEM under test -- validate detectionOutput: full purple-team BAS at zero license cost.
2. Customer-managed commercial BAS
Cymulate (or SafeBreach, AttackIQ, Picus)
Output: managed delivery; continuous-validation heatmaps; per-detection-gap remediation playbooks.
3. Autonomous-pentest tier
Pentera -- chained-attack engine (more pentest than BAS)
+ Caldera/ART -- specific-technique BAS alongsideOutput: realistic chained-attack simulation complementing isolated-technique BAS.
Cost Tier
Annual TCO for a 1000-user customer environment.
| Tier | Tooling | Approx Cost |
|---|---|---|
| Free | Caldera + ART + Stratus + Infection Monkey | $0 + operator time |
| Mid | Cymulate / SafeBreach / AttackIQ / Picus | $50,000-150,000 / year |
| High | Pentera (autonomous-pentest tier) | $100,000-300,000 / year |
Tools
10 tools.
Atomic Red Team
Red Canary’s open-source library of small portable ATT&CK-aligned tests; the canonical OSS BAS reference content.
License: MIT (OSS) · Kind: library · Deploy: direct, package · SSO: none
ResorsIT usage: Library
AttackIQ
Commercial BAS platform; FlexECT cloud-based scenario engine; one of the three established BAS market leaders.
License: Proprietary (proprietary) · Kind: web · Deploy: saas, direct · SSO: OIDC, SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on · Provisioned account
Cobalt Iceberg
Cobalt.io’s continuous-pentest tier; blends PtaaS marketplace with BAS-style scheduled / continuous testing.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on · Provisioned account
Cymulate
Commercial BAS / continuous threat-exposure-management platform; Israeli vendor; one of the three established BAS leaders.
License: Proprietary (proprietary) · Kind: web · Deploy: saas, direct · SSO: OIDC, SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on · Provisioned account
Infection Monkey
Open-source automated breach-and-attack simulation tool from Akamai (acquired Guardicore); tests lateral-movement defences by spreading through the network.
License: GPL-3.0-only (OSS) · Kind: service · Deploy: docker, direct · SSO: OIDC
ResorsIT usage: Deployment Payload
Access & Identity: Single sign-on · Local host account · Key-based access
MITRE Caldera
MITRE’s automated adversary emulation platform; ATT&CK-aligned, plugin-driven, the canonical OSS BAS framework.
License: Apache-2.0 (OSS) · Kind: web · Deploy: docker, direct · SSO: OIDC, SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on
Pentera
Israeli commercial autonomous-pentest / BAS platform; chained-attack engine; stronger autonomous-pentest positioning than the Cymulate / SafeBreach trio.
License: Proprietary (proprietary) · Kind: web · Deploy: saas, direct · SSO: OIDC, SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on · Provisioned account
Picus Security
Turkish commercial BAS / CTEM platform; broad ATT&CK coverage + remediation playbook depth; growing European presence.
License: Proprietary (proprietary) · Kind: web · Deploy: saas, direct · SSO: OIDC, SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on · Provisioned account
SafeBreach
SafeBreach is a commercial breach and attack simulation platform whose Hacker’s Playbook offers 30,000+ curated attack scenarios mapped to MITRE ATT&CK, run via a SaaS console with on-prem simulators.
License: Proprietary (proprietary) · Kind: web · Deploy: saas, direct · SSO: OIDC, SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on · Provisioned account
Stratus Red Team
DataDog’s cloud-native attack-emulation library; ATT&CK-aligned techniques executed directly against AWS / Azure / GCP / Kubernetes accounts.
License: Apache-2.0 (OSS) · Kind: cli · Deploy: direct, docker, package · SSO: none
ResorsIT usage: Deployment Payload
Access & Identity: Local host account · Key-based access
