Security validation

Security validation

Validate whether attacks are detected — and whether they succeed


Create an attack campaign to measure the effectiveness and operational readiness of your security strategy against real attack paths, going beyond a point-in-time pentest.
A single campaign feeds two complementary readings of the same results:
  • Detection & response: are the offensive behaviors detected and blocked by your existing tools, and how fast?
  • Exploitability: did the actions actually succeed from an attacker's standpoint, revealing an exploitable weakness?
Automate the first reading. Attach a connector in Automatic mode and the detection reading is built without manual qualification: BlackNoise fills in each event's detection status, source and date from your tools' data, and the grade and indicators are established as soon as the simulation's connector data has been gathered.


Create and run the campaign

You can build a campaign and launch a simulation in a few minutes.

1) Choose a scenario

From Threat Library > Scenarios, pick a scenario. It serves as the template that generates the campaign's ordered list of events. The total number of events run depends on the number of targets in scope: each event that applies to a target runs once per target.

2) Fill in the campaign details

The name and description are pre-filled from the scenario; you can edit them. Add the target type (used only to generate graphs and KPIs), then select the Attack Vector that will execute the events.

3) Define the scope

The scope depends on the selected scenario. Enter one or more of:
  • Network scope: IPv4 addresses or CIDR ranges targeted at network level (for example scans), separated by spaces (e.g. 192.168.1.0/24 ).
  • System scope: for a system scenario, select from your existing System Targets, or create a new one.
  • Cloud scope: for a cloud scenario, select from your existing Cloud Targets, or create a new one.
A connection test runs on the campaign's scope and checks that the Attack Vector can reach each target. For a System Target, it checks that the remote-access method (SSH, WinRM or WMI) is enabled, that the flows are open and that the credentials are valid. For a Cloud Target, it checks that the HTTPS flow to Azure is open and that the credentials are valid. You can move to the next step only if the tests pass.

4) Define the execution conditions

  • Simulation start: immediate (run now) or scheduled for later.
  • Events launch: automatic (events chain on their own, with an optional delay between each) or manual (you start each event from the app). The inter-event delay is configurable from 0 (continuous) to 60 minutes; the 1-minute default makes detection data easier to analyze.
  • Connectors: optionally attach one or more configured connectors to enrich results with EDR/NDR/XDR data. For each connector, choose a detection qualification mode: in Automatic mode, BlackNoise qualifies each event's detection for you from the connector's data; in Semi-automatic mode, you qualify it yourself. See  Connectors .
A summary of the campaign is shown. Click Start, or Plan for a scheduled run.


Assess detection and response

Once the simulation is complete, use its results to evaluate your detection and response.
Qualify each event. For every executed event, set the detection status and enrich it with the detection source, date & time, and evidence. With a connector in Automatic mode, BlackNoise fills in the status, source and date for you, and you can still correct them and add evidence. Otherwise, qualify the events manually, in the app or via the API.
Read the results. Scores, graphs and KPIs update in real time from the data you provide or that a connector fills in. With a connector in Automatic mode, the grade and the detection indicators are established as soon as the connector data has been gathered, without manual qualification. On this axis you can identify blind spots (behaviors no tool detects), measure detection speed, and see which detection tools contribute the most and the least.


Identify exploitable weaknesses

The detection axis measures whether your tools saw the attack. The same results also reveal the outcome of the attack itself: for the executed actions, whether the action succeeded and an exploitable weakness was identified. Each event carries an exploitation status — Exploited, Contained or N/A — recording this outcome; see  Event statuses & severity .
Two things to keep in mind when reading these findings:
  • "Weakness" is broad. It may be a genuine vulnerability, or a misconfiguration, both are reported.
  • Results depend on the privileges granted for the test. The same action can succeed or fail depending on the rights of the account or application used to run it (for example, an admin account provided on the target). Read exploitability findings together with the scope and credentials you set for the campaign.