BAS is the testing practice: replaying adversary techniques against live controls. A BAS platform is the software that schedules those simulations, stores the evidence, and lets you retest after a change.
Platform Guide
What a Breach and Attack Simulation Platform Includes
The parts a breach and attack simulation platform needs — scenario library, test points, evidence, integrations, and retest — and how that system differs from a one-off exercise.
The System Behind the Practice
A platform is what makes validation repeatable.
A breach and attack simulation platform is…
Software that safely replays adversary techniques against live security controls, records whether each control blocked, detected, logged, or missed the activity, and runs the same test again after a fix.
Breach and attack simulation is the practice. The platform is the console, library, test points, and evidence trail that let a SOC run that practice on a schedule instead of as a project.
Category pages and independent explainers describe the same shape: test points inside the environment, a library mapped to MITRE ATT&CK, and a result for every technique. The useful question is which of those parts your team can operate every week.
The practice
Authorised replay of known adversary techniques, so you can see how live controls respond on a given day.
The platform
The console, library, test points, integrations, and reports that turn that replay into a continuous programme.
The evidence
A per-technique record of blocked, detected, logged-only, or missed, plus a retest after the control changes.
Scope of the Platform
What belongs in the platform, and what stays outside it.
A BAS platform measures controls you already operate. It does not replace the controls, the scanner, or the people who find new paths.
The platform includes
- A scenario library mapped to ATT&CK tactics and techniques
- Test points on the hosts, segments, and mail paths you authorise
- Safe execution that produces telemetry without destructive impact
- Separate results for prevention and for detection
- Scheduling, drift alerts, and a retest of the same scenario
- Exports a SIEM, ticket queue, or audit pack can consume
The platform leaves in place
- Vulnerability scanning and patch priority
- Human penetration tests and red-team objectives
- Threat-intelligence collection as its own discipline
- EDR, email gateway, firewall, and SIEM — the controls under test
- Novel research your library has not encoded yet
Operating Parts
Six parts a team should be able to point at.
If a vendor demo cannot show these as separate objects — not slides — the platform will be hard to run after the pilot.
Management console
Who can launch a simulation, who approves scope, and which environments are in play. Production and lab should be distinct.
Scenario library
Techniques and short campaigns tagged to ATT&CK, refreshed when the threats you track change — not a static pack from install day.
Test points
Agents or equivalent runners placed only where change control allows: endpoints, servers, mail paths, and network segments.
Outcome model
Blocked, detected, logged only, and missed, recorded per control layer. A single pass/fail hides whether the SIEM ever saw the event.
Integrations
SIEM, EDR, and ticketing so a failed technique becomes a task with an owner, not a PDF that expires in a shared drive.
Retest
The same scenario runs again after the rule or policy change, and the platform stores the before and after side by side.
Evidence Standard
Questions the platform should answer without a follow-up meeting.
| Question | What a useful answer looks like |
|---|---|
| Which technique? | An ATT&CK technique or sub-technique, not a vague malware label |
| Which control? | EDR, email gateway, firewall, or SIEM — named, not “the stack” |
| What happened? | Blocked, detected, logged only, or missed, with the time of the run |
| Was the alert usable? | Whether detection arrived with enough context to investigate |
| Did it regress? | A technique that passed last month and fails after a policy change |
| Is the gap closed? | A retest of the same scenario after remediation |
Frequently Asked QuestionsBAS platform scope,
BAS platform scope,
answered.
No. Endpoint, email, network, and SIEM products remain the controls. The platform measures whether they prevent and detect the techniques you selected.
A penetration test is a point-in-time narrative of paths a human found. Platform evidence is a technique-level score you can run again next week without booking another engagement.
Detection engineering and the SOC usually own scenarios and tuning. Control owners for endpoint, email, and network own the fixes. Leadership reads the trend, not every technique row.
It is designed to be, when simulations use inert artefacts inside an authorised scope, with exclusion lists and a change window. Safety comes from the execution model and the approval process together.
Related reading and resources
See how the platform runs, how to choose one, and how Valitrix validates endpoint, email, network, and SIEM controls.
See the parts in one platform
See how Valitrix records a result for every technique.
Request a demo and walk through scope, a simulation, the control outcome, and the retest — the operating loop a BAS platform has to sustain.