A SOC manager or head of detection, with a CISO who will read trends. Endpoint, email, and network leads have to accept the fixes. Without those leads, the programme produces findings and no change.
Programme Guide
How to Run a Breach and Attack Simulation Programme
An operating model for a breach and attack simulation programme: scope, owners, cadence, change control, remediation, and what the first 90 days should produce.
A Programme, Not a Tool Rollout
The platform is ready when the operating rhythm is.
A BAS programme is…
The scope, people, cadence, and remediation path that keep authorised simulations running, turn misses into control changes, and prove those changes with a retest.
Teams stall when the software is live and nobody owns the weekly pack. The programme names that owner, the control owners who implement fixes, and the rule for what gets tested next.
Purple-team exercises and red-team findings feed the programme. They do not replace the schedule. Anything worth worrying about twice becomes a scenario.
Operator
Runs the pack, checks that results arrived, and refuses to expand scope faster than remediation.
Control owner
Changes the EDR policy, gateway rule, firewall path, or SIEM content the result pointed at.
Sponsor
Reads drift and closure trends, and protects the weekly time the programme needs.
First 90 Days
A quarter that ends with a habit.
01
Days 1–30: scope and baseline
Approve hosts and exclusions. Run a small pack across two control planes. Publish the outcome model so “missed” means the same thing to everyone.
02
Days 31–60: close a few gaps
Pick misses an owner can fix in a sprint. Open tickets with the scenario attached. Retest. Do not add fifty techniques while the first ten are open.
03
Days 61–90: make it a calendar
Put the pack on a weekly schedule. Add a trigger for policy changes. Show leadership the closures and the regressions, not a tour of the console.
04
After day 90: widen on purpose
Add techniques from threat reporting or a purple-team day only when the retest habit is holding. Encode new findings. Retire scenarios you no longer care about.
Roles
Four seats, even if one person holds two.
Programme operator
Maintains scope, schedule, and scenario hygiene. Escalates when a run fails for operational reasons rather than a detection gap.
Detection engineering
Turns logged-only and missed results into rule changes, then asks for the retest before closing the work.
Control owners
Endpoint, email, and network owners implement prevention changes and remove exceptions that the simulation keeps proving.
SOC leadership
Uses the trend to staff tuning work and to brief the CISO. Shields the cadence from one-off demo requests.
Weekly Rhythm
A calendar the programme can survive.
| When | Who | Output |
|---|---|---|
| Weekly run | Operator | Fresh outcomes for the priority pack |
| Triage | Operator and detection engineering | Misses split into fix, accept, or needs scope review |
| Change | Control owner | Policy or rule updated, scenario ID noted |
| Retest | Operator | Pass, still missed, or partial — stored beside the original |
| After a control change | Operator | Dependent scenarios rerun outside the weekly slot |
| Monthly readout | SOC leadership | Closures, regressions, and untested tactics you refuse to call covered |
Frequently Asked QuestionsRunning the programme,
Running the programme,
answered.
Small enough to triage in a single sitting. A few dozen techniques across two control planes is plenty. Expand only after retests are closing.
Approve the execution model, the host groups, and the window once. Individual weekly runs of already-approved scenarios should not need a fresh board meeting, or the cadence will die.
Record it as accepted, with an owner and a review date. Leaving it as an unexplained red cell teaches the team to ignore the console.
If the finding can be expressed as a repeatable, safe technique, add it to the library and schedule it. If it depended on operator creativity, keep it in the exercise report and do not pretend the platform covers it.
Related reading and resources
The programme sits on the platform loop, the control tests, and the metrics leadership will ask for.
Start with a 30-day baseline
Leave the demo with a pack your team can run weekly.
Request a Valitrix working session and map scope, a first scenario pack, and the retest path — the pieces a programme needs before the licence does any good.