Breach and attack simulation (BAS) is software that replays known attacker techniques safely inside a company's own network, to check which of its defences notice and stop them. It runs automatically, often every day or every week. It does not use real harmful software, and it does not damage anything. BAS is one of the methods of offensive security testing.
A company buys many defences: a firewall at the edge of the network, endpoint detection and response (EDR) software on every laptop, and a SIEM that raises alerts from the logs. Each defence is set up once and then trusted. But settings change, rules are switched off by mistake, and new laptops arrive without the software. So a defence that worked in January may stop working in June without anyone noticing. BAS checks again, regularly.
The techniques come from a public catalogue called MITRE ATT&CK. It describes hundreds of methods that real attacker groups have used. Examples are copying passwords from a computer's memory, or sending stolen files out over a disguised connection. A BAS tool has a safe version of each method. Small programs, called agents, are installed on a few test machines in different parts of the network. They act out each technique and record what each defence did.
Take, for example, a steel company in Jamshedpur. Every Sunday night, its BAS tool runs 60 techniques from test laptops in the office, in the plant and in the cloud. This week, the EDR software blocks 44 of them. The SIEM raises an alert for 10 more, which were not blocked. Six techniques pass without any alert at all. One of them sends a test file out to the internet over a disguised connection. The tool shows that a firewall rule for that kind of traffic was switched off during a change two weeks ago. The network team switches it back on. The next run shows the technique blocked.
The result is a list of gaps, with the setting that would close each one. Many tools also show the results as a map of the catalogue, coloured by whether each technique was blocked, seen or missed.
BAS is different from penetration testing. A penetration tester is a person who looks for new ways in, for a few weeks. BAS repeats known techniques, automatically, all year. It cannot find a new flaw, but it notices quickly when a defence stops working. BAS is also close to network change verification, which checks a planned network change on a software model before the change is made. BAS checks the real network after the change.