Security validation

Security validation

Validate whether attacks are detected — and whether they succeed


Create an attack campaign to measure the effectiveness and operational readiness of your security strategy against real attack paths, going beyond a point-in-time pentest.
A single campaign feeds two complementary readings of the same results:
  • Detection & response: are the offensive behaviors detected and blocked by your existing tools, and how fast?
  • Exploitability: did the actions actually succeed from an attacker's standpoint, revealing an exploitable weakness?


Create and run the campaign

You can build a campaign and launch a simulation in a few minutes.

1) Choose a scenario

From Threat Library > Scenarios, pick a scenario. It serves as the template that generates the campaign's ordered list of events. The total number of events run depends on the number of System Targets in scope: each system-level event runs once per System Target.

2) Fill in the campaign details

The name and description are pre-filled from the scenario; you can edit them. Add the target type (used only to generate graphs and KPIs), then select the Attack Vector that will execute the events.

3) Define the scope

Depending on the scenario, enter one or both:
  • Network scope: IPv4 addresses or CIDR ranges targeted at network level (for example scans), separated by spaces (e.g. 192.168.1.0/24).
  • System scope: select from your existing System Targets, or create a new one.
A connection test checks that the remote-access method (SSH, WinRM, WMI) is enabled and that the flows are open between the Attack Vector and each System Target. You can move to the next step only if the tests pass.

4) Define the execution conditions

  • Simulation start: immediate (run now) or scheduled for later.
  • Events launch: automatic (events chain on their own, with an optional delay between each) or manual (you start each event from the app). The inter-event delay is configurable from 0 (continuous) to 60 minutes; the 1-minute default makes detection data easier to analyze.
  • Connectors: optionally attach a configured connector to enrich results with EDR/NDR/XDR data. Once active, it automatically processes results and qualifies each event's detection. See  Connectors .
A summary of the campaign is shown. Click Start, or Plan for a scheduled run.


Assess detection and response

Once the simulation is complete, use its results to evaluate your detection and response.
Qualify each event. For every executed event, set the detection status and enrich it with the detection source, date & time, and evidence. This can be done manually, or automatically via API or a connector.
Read the results. Scores, graphs and KPIs update in real time from the data you provide. On this axis you can identify blind spots (behaviors no tool detects), measure detection speed, and see which detection tools contribute the most and the least.


Identify exploitable weaknesses

The detection axis measures whether your tools saw the attack. The same results also reveal the outcome of the attack itself: for the executed actions, whether the action succeeded and an exploitable weakness was identified. Each event carries an exploitation status — Exploited, Contained or N/A — recording this outcome; see  Scores & statuses .
Two things to keep in mind when reading these findings:
  • "Weakness" is broad. It may be a genuine vulnerability, or a misconfiguration, both are reported.
  • Results depend on the privileges granted for the test. The same action can succeed or fail depending on the rights of the account used to run it (for example, an admin account provided on the target). Read exploitability findings together with the scope and credentials you set for the campaign.