It can, inside an authorised host group, with inert simulations and exclusions. Many teams start on a representative pilot group, then widen the schedule once operations trusts the execution model.
Control Guide
What a Breach and Attack Simulation Platform Tests
What a breach and attack simulation platform tests across endpoint, email, network, and SIEM — and the prevention and detection questions each control is expected to answer.
Controls in the Path
The platform tests the stack you deployed, one technique at a time.
A BAS platform tests…
Whether endpoint, email, network, and SIEM controls prevent or detect authorised, inert adversary techniques — including cases where one layer blocks the activity and another layer never records it.
Product pages in the category list the same surfaces: endpoint, network, email, web, and cloud, with the SIEM as the detection backbone. The test is not “is the product installed?”. The test is “what did this control do with this technique today?”.
Valitrix focuses that question on endpoint, email, network, and SIEM, with every simulation mapped to MITRE ATT&CK so the answers can sit on one heatmap.
Prevention question
Did the control stop the technique before it completed?
Detection question
Did an alert fire with enough context for an analyst to investigate?
Pipeline question
Did the relevant log arrive in the SIEM, parse, and match a rule — or die on the way?
Where Tests Run
Four control planes, four different failures.
Endpoint
EDR, XDR, and antivirus facing ransomware-like behaviour, execution, and other ATT&CK techniques — inert, and scoped to approved hosts.
Endpoint validationWhether the gateway stops phishing, malicious attachments, and spoofing patterns you have authorised the platform to send.
Email gateway testingNetwork
Whether firewall, DNS, and egress controls deal with command-and-control and exfiltration behaviours inside the approved segments.
Network validationSIEM
Whether the event was ingested, parsed, correlated, and raised as an alert a person can work. A block upstream can still hide a broken detection.
SIEM validationPer-Control Questions
The question each plane should answer.
| Control plane | The platform asks |
|---|---|
| EDR / XDR / AV | Did prevention or behavioural detection fire on this technique? |
| Email gateway | Was the authorised phishing or attachment scenario blocked or detected? |
| Firewall and DNS | Was the approved C2 or egress behaviour stopped? |
| Egress / DLP path | Was the authorised exfiltration behaviour blocked or logged? |
| SIEM content | Did the expected rule fire with usable context? |
| Log pipeline | Did the source arrive and parse, even when prevention already blocked the technique? |
Bounds of the Test
What these tests prove, and what they leave to other work.
These tests prove
- A named control’s response to a named technique
- Whether detection still works after a policy change
- Gaps between a blocked endpoint and a silent SIEM
- Regression against your own previous result
- Evidence you can hand to the control owner
Other work still proves
- Whether a new vulnerability is exploitable in your estate
- Creative, objective-based attack paths
- Business-logic flaws in applications
- Physical and social scenarios outside the library
- Asset inventory and exposure discovery on their own
Frequently Asked QuestionsControl testing,
Control testing,
answered.
Because the next variant may only be detected, not blocked. If the log never arrives or the rule is wrong, detection fails on the day prevention does not save you.
No. Gateway testing asks whether the mail control stopped the scenario. Awareness exercises measure human reporting. They can coexist. They are different results.
Yes. A delivery-to-execution-to-egress sequence can show which plane stopped the chain and which plane stayed silent. Record an outcome per plane, not one score for the story.
Treat them as further planes with the same rule: a named technique, a named control, and a prevention or detection result. Do not fold them into “endpoint” if the evidence lives elsewhere.
Related reading and resources
Open the control pages, or read how ransomware-related techniques are validated without destructive impact.
Test the planes you already pay for
See endpoint, email, network, and SIEM on one technique.
Request a Valitrix demo and compare prevention and detection across the controls in the path, instead of trusting a single product’s console.