<div id="readability-page-1"><div>Co-Founder &amp; CTO of Cymulate. Previously, Avihai was the Head of the Cyber Research Team at Avnet Cyber &amp; Information Security 
<figure> 
 <img src="https://imageproxy.pbkrs.com/https://specials-images.forbesimg.com/imageserve/5eea0f35fa37d800062b82f9/960x0.jpg/query-Zml0PXNjYWxl?x-oss-process=image/auto-orient,1/interlace,1/resize,w_1440,h_1440/quality,q_95/format,jpg" alt="Network security" original-src="https://imageproxy.pbkrs.com/https://specials-images.forbesimg.com/imageserve/5eea0f35fa37d800062b82f9/960x0.jpg/query-Zml0PXNjYWxl"/> 
 
 <figcaption> 
 Getty 
 </figcaption> 
</figure> 
 
The market for automated security testing, or breach and attack simulation (BAS), is on fire, with analysts predicting an almost 35% compound annual growth rate and over $900 million market size in 2025. The growing appetite for this kind of solution has spawned different flavors of automated testing. Common to all of them is the capability to launch attacks that challenge an organization's IT system and its security controls, with the objective of identifying and closing security gaps. But what do they mean when they say &#34;attacks&#34;? 
A great place to start is the MITRE ATT&amp;CK framework. It advanced the security industry by describing the tactics and techniques used by threat actors across the cyber kill chain. This knowledge base fast became a de-facto common language for vendors, security practitioners and analysts to describe attacks and the techniques they employ. It also enables organizations to describe how their security architectures stack up to different techniques, and this is where automated security testing and validation comes in. By launching attacks, these solutions are supposed to provide visibility, uncovering the strengths and weaknesses of a security architecture before a threat actor does. We can group the attacks used by automated testing platforms into three groups. 
 
1. Real Attacks 
Real attacks are a combination of tools, payloads and techniques that were originally devised by a threat actor to achieve a specific objective — for example, to steal intellectual property or hold data for ransom. In the context of automated security testing, they are represented by the IOCs of a specific attack/malware. A real attack will answer the important question, &#34;Are we protected against a specific threat?&#34; 
 
While this is a valuable question, similar to a pen test, its answer is limited in scope, and it is related to the specific attack that was launched. It does little to shed light on the overall operational effectiveness of a security architecture. This is because the techniques used by the attack/malware are far more important than the specific attack. A security architecture that can withstand this specific attack does not guarantee that it can defend against a different threat that employs the same techniques in a slightly different combination, sequence or set of dependencies. Nonetheless, organizations like to have a quick answer to the question, &#34;Are we also susceptible to an attack that hit the headlines last night?&#34; 
 
2. Atomic Techniques 
Atomic techniques are implementations of individual threat actor techniques, and the most commonly used knowledge base and reference for this is the MITRE ATT&amp;CK framework. Launching this type of attack is supposed to be useful to validate detection or prevention of specific techniques — for example, techniques used to escalate privileges. The decoupling of the technique being tested to other techniques allows security teams to focus on a specific concern. And assuming many different implementations of this technique are realized in the automated testing platform, it should provide visibility and even measure an organization's security effectiveness against it being successful. For example, can a threat actor that has somehow landed in my network gain rights to access privileged resources through the use of privilege escalation techniques? 
And yet the disadvantage of atomic techniques, compared to real attacks, is a total lack of context. In many cases, this significantly reduces their effectiveness. For example, by combining evasion with credential access techniques, we would probably face a very different result compared to atomic executions of the same techniques. When simulating attacks, it is far more important to simulate adversarial behaviors and then reference them to the ATT&amp;CK framework, as opposed to focusing on specific techniques. 
3. Contextual Attacks 
Like many things in life, the answer lies somewhere in between — in this case, between real attacks and atomic attacks. By implementing combinations of techniques that are contextually compatible, we achieve lifelike attacks that focus on a specific link in the cyber kill chain. For example, password cracking that uses Kerberoasting is a behavior that would combine evasion together with credential access techniques, realized in the following flow and mapped to the following ATT&amp;CK techniques. By launching a myriad of these combinations, achievable only through automation, we get visibility on the overall operational effectiveness of a security architecture. 
A Word On Simulation 
When Gartner named the market breach and attack simulation (BAS), it triggered yet another marketer’s war of words, as if the cyber industry needed more of these. In this case, attack simulations versus real attacks. Every proactive test is a simulation of a real event. The idea is to make them as real as possible without disrupting the business, thus enabling testing in production. After all, you want to test your actual defenses, not a simulation of them. 
For example, a ransomware attack simulation will attempt to encrypt files created for the purpose of the simulation. This is as real as you can get without facing the catastrophic results of an actual attack. Continuous security validation, as I prefer to call it, should be able to answer both the question, &#34;Could our organization fall victim to a specific threat or real attack that hit the headlines?&#34; and the more valuable question, &#34;How operationally effective are our defenses?&#34; By leveraging threat intelligence-led, real attacks and contextual attacks or attack combinations can security validation provide the visibility for security teams to prioritize their efforts and optimize their security architecture. 
<hr/> 
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify? 
<hr/> 
 
</div></div>

Like many things in life, the answer lies somewhere in between — in this case, between real attacks and atomic attacks.

Council Post: Automated Security Testing: Putting Attacks Into Context