Definition
Adversary emulation is security testing that copies the tactics, techniques and procedures of a specific real-world threat group, to see whether an organisation would stop or detect that attacker.
What adversary emulation is
Adversary emulation is a type of security testing that copies the behaviour of a specific, real-world threat group. Instead of attacking in any way that works, the testers follow the tactics, techniques and procedures (TTPs) that a known group has been seen using, step by step.
The question it answers is very concrete: if the group most likely to target us attacked tomorrow, using the methods they are known for, would we stop them or at least see them?
How adversary emulation works
- Choose the adversary. Use threat intelligence to pick a group that is relevant to your industry, region or the data you hold, for example a ransomware operator or a state-sponsored group.
- Build an emulation plan. Turn what is known about that group into a sequence of techniques, usually mapped to the MITRE ATT&CK framework, from initial access through to their typical objective.
- Agree the rules of engagement. Define the scope, the systems involved, safety limits and who knows about the test.
- Execute the plan. Run each technique the way the adversary would, often across several days or weeks.
- Observe the defence. Record which steps were blocked, which were detected and which went unnoticed.
- Report and improve. Share the results with the blue team, fix gaps in prevention and detection, and repeat the techniques to confirm the fixes work.
Adversary emulation vs other types of testing
| Approach | What it focuses on | Main question |
|---|---|---|
| Penetration test | Finding and confirming vulnerabilities in a defined scope | What can be exploited? |
| Red team exercise | Reaching an objective by any realistic means, while staying hidden | Could an attacker reach their goal unnoticed? |
| Adversary emulation | Repeating the known techniques of a specific threat group | Would we stop or detect this particular attacker? |
| Adversary simulation | Realistic attack scenarios, not tied to one exact group | How do we cope with this type of attack? |
| Breach and attack simulation | Automated, repeatable checks of security controls | Are our controls still working today? |
The terms overlap in practice. Many red team exercises include emulation of a named group, and adversary simulation is sometimes used to mean the same thing as emulation.
MITRE ATT&CK and emulation plans
MITRE ATT&CK is a public knowledge base of attacker tactics and techniques, built from real incidents. It is the common language of adversary emulation: each step of an emulation plan is described as an ATT&CK technique, and the results can be shown as a map of what the defence covered and what it missed.
MITRE's Center for Threat-Informed Defense publishes ready-made emulation plans for several well-known groups. Open-source tools such as MITRE Caldera and Atomic Red Team help teams run individual techniques or whole plans in a controlled way.
Choosing which adversary to emulate
- Your sector: financial services, healthcare, manufacturing and government each attract different groups
- Your region: some groups focus on specific countries or regions
- Your assets: payment data, intellectual property or operational technology attract different motives
- Current threats: groups that are active right now, especially ransomware operators, are often the most useful to emulate
- Past incidents: techniques already used against you or your peers
Benefits of adversary emulation
- Threat-informed: testing focuses on the attackers you are most likely to face, not on generic scenarios
- Measures detection, not just prevention: it shows exactly which steps the blue team saw
- Repeatable: the same plan can be run again after changes to prove improvement
- Clear communication: results mapped to known groups and ATT&CK techniques are easy to explain to leadership
Limitations
- It depends on good intelligence: if the wrong adversary is chosen, the test answers the wrong question
- Attackers change: groups adopt new techniques and tools, so plans age
- Narrow by design: following one group's playbook can miss weaknesses that a different attacker would find
- Effort: building and running a good plan takes skilled people and time
How Plainsea helps
Adversary emulation shows how you would hold up against one specific group. Plainsea covers the wider question in between those exercises: within the scope you set, AI agents use real attacker techniques to find weaknesses, try to exploit them and chain them into attack paths, and every finding is confirmed before it reaches your team. Because testing can run continuously, the gaps any attacker could use are found and re-tested as your environment changes.