ATT&CKLab
Adversary emulation and security control validation built on MITRE ATT&CK
Safely emulate real attacker behaviour across the MITRE ATT&CK matrix and prove whether your EDR, SIEM, NGFW and MFA actually detect and stop it.
- Atomic techniques across the full ATT&CK matrix
- Pre-built APT, ransomware and insider playbooks
- Zero production impact via sandboxing and blast-radius limits
What this module does
This special security testing module is designed to evaluate an organisation's cyber resilience by safely emulating real attacker behaviour. It leverages the MITRE ATT&CK framework to execute a wide range of attack techniques in a controlled environment, revealing how well existing security controls can detect, prevent, and respond to threats.
The module can run either small, targeted tests for specific controls or fully automated end-to-end attack chains that mimic real-world intrusions. After testing, detailed reports highlight which attacks were blocked, which bypassed defences, and where improvements are needed — providing clear insight into the effectiveness and ROI of your security investments.
ATT&CKLab in the console
Real screens from the PentestBX platform — swipe or use the arrows to look around.
Adversary profiles
Start a simulation from one of 39 adversary profiles — APT10, APT28, APT29 and more.
Everything in ATT&CKLab
Each capability is available on its own or combined with the other modules in a single subscription.
Simulation of Attacker Techniques
Emulates real adversary TTPs across all stages of the MITRE ATT&CK matrix — reconnaissance, phishing, credential harvesting, lateral movement, privilege escalation, persistence, and exfiltration. Each technique is modularised into atomic steps, enabling precise visibility into which controls detect or miss each stage. All executions are sandboxed and risk-controlled.
Automated Attack Scenarios
A rich library of pre-built scenarios (APT profiles, ransomware playbooks, insider threat simulations) can be launched on demand or scheduled. Each supports parameter customisation — target scope, agent type, timing, noise level — while the orchestrator manages dependencies automatically.
Security Control Validation
Validates the detection and prevention capabilities of your defensive stack — EDR, NGAV, SIEM, NGFW, CASB, and MFA. Each run records which alerts were triggered, what telemetry was generated, and which controls failed, automatically collecting logs, process trees, and packet captures as evidence.
Granular Test Modules
Composed of reusable atomic modules — SMB lateral movement, credential access, PowerShell persistence — allowing highly granular tests. Each module supports timeouts, command overrides, and risk levels for fine-grained control over test behaviour.
Full Automation
Handles every stage — start, monitor, retry, and cleanup — automatically, enabling continuous security validation without manual intervention. Integrates with CI/CD pipelines to trigger regression tests after new patches or configuration changes.
Measurable Results
Generates KPIs for each execution: time-to-detect (TTD), time-to-respond (TTR), coverage and detection mapping, failed steps, and overall risk scores — visualised through dashboards with trend analytics, SLA tracking, and executive summaries.
Customisable Scenarios
A drag-and-drop builder lets users create organisation-specific attack scenarios. Add conditional logic, pre/post conditions, and branching flows to match realistic attack paths aligned with your threat model.
Continuous Testing
Runs continuously or on a schedule to verify that security controls remain effective over time, automatically re-testing when new vulnerabilities or configuration changes are detected so your defences don't degrade silently.
Adversary Emulation Profiles
Predefined APT and threat actor profiles with unique TTP combinations, customisable based on sector and regional threat landscape.
Safe Sandbox & Risk Controls
All simulations include strict safety measures — access throttling, automatic rollback, blast-radius limitation, approval workflows, and maintenance-window integration — guaranteeing zero production impact.
Bring ATT&CKLab into your security programme
Size your estate in the configurator and request a tailored quote, or start a trial straight away.