Scope control, safe execution, a small ATT&CK-mapped library, and a clear missed-versus-detected result. Scheduling and executive reporting matter once someone is running the pack every week.
Capability Guide
Breach and Attack Simulation Platform Capabilities
The capabilities a breach and attack simulation platform needs in production: safe execution, ATT&CK mapping, multi-control results, scheduling, drift detection, integrations, and audience-specific reporting.
Capabilities, Not Feature Labels
A capability is something an operator can run on Tuesday.
BAS platform capabilities are…
The repeatable functions that let a security team select a technique, run it safely against a live control, see a prevention and detection result, assign the gap, and prove the fix with a retest.
Vendor pages emphasise libraries, MITRE coverage, remediation guidance, and continuous scheduling. Those labels only count if an operator can complete the loop without a professional-services project each time.
Split the checklist into what you need on day one and what can wait until the programme has an owner and a cadence.
Day-one capabilities
Scoped execution, a technique library, per-control outcomes, and a way to export the miss.
Programme capabilities
Schedules, drift alerts, SIEM checks, ticketing, and separate views for engineers and leadership.
The test of a capability
A named person can demonstrate it on your controls during the pilot, then again without the vendor on the call.
Checklist
Must-have now, add when the cadence is real.
Must-have
- Authorised scope and a stop control
- Inert execution with an audit log of what ran
- ATT&CK technique identifiers on every scenario
- Blocked, detected, logged-only, and missed
- Results separated by endpoint, email, network, and SIEM
- Retest of a scenario after a control change
Add as the programme matures
- Scheduled packs and change-triggered reruns
- Drift alerts when a passing technique fails
- Ticket creation with the scenario linked
- Role-based reports for SOC, engineers, and the board
- Threat-informed prioritisation of what to run next
- Campaign sequences that chain a few techniques in order
Capability Groups
Four groups worth holding a vendor to.
Content
Scenarios a detection engineer can recognise, mapped to techniques, with enough detail to know what “detected” referred to.
ATT&CK coverageExecution
Test points, schedules, and safety controls that operations will approve more than once.
How execution worksEvidence
Timestamped outcomes per control, including whether the SIEM alert was usable, kept long enough for an audit sample.
SIEM validationAction
A path from miss to owner to change to retest. Reporting that stops at a heatmap does not change the control.
What to measureWhat Good Looks Like
Capability versus a working version of it.
| Capability | Working version |
|---|---|
| Scenario library | Techniques you can filter by tactic, control, and priority |
| Safe simulation | An execution log and a written boundary on destructive actions |
| ATT&CK mapping | Technique IDs stored on the result, not only in a marketing matrix |
| SIEM validation | Expected detection name checked, not a manual screenshot |
| Drift detection | Alert when last month’s pass becomes this month’s miss |
| Remediation | Ticket plus a retest bound to the same scenario |
| Executive reporting | Trend of missed techniques and closures, without raw telemetry |
Frequently Asked QuestionsCapabilities,
Capabilities,
answered.
Mapping is a day-one capability. Running every technique is not. Start with the tactics your controls claim to cover and expand once retests are happening.
Not on day one. You need it when a purple-team exercise or a threat report produces a technique your library does not contain and you want that technique on the weekly schedule.
Specific guidance helps when it matches the EDR, gateway, or SIEM you run. Generic advice still needs a person who can implement it. The capability that matters is the retest after they do.
A platform capability is something your team can operate. A managed service can run the platform for you, but the control change still belongs to the people who own EDR, email, network, and SIEM content.
Related reading and resources
Use the checklist alongside the buyer’s guide and the controls Valitrix validates.
Check the capabilities on your stack
See content, execution, and retest in one session.
Request a Valitrix demo focused on the capabilities you need in the first month: scoped execution, a technique result, and a retest after a control change.