What it does. Deploys Breach and Attack Simulation (BAS) platforms such as SafeBreach, Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill implementing-continuous-security-validation-with-bas, or copy the skill folder into ~/.claude/skills/implementing-continuous-security-validation-with-bas/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-continuous-security-validation-with-bas/SKILL.md

SKILL.md (verbatim)

name: implementing-continuous-security-validation-with-bas
description: Deploys Breach and Attack Simulation (BAS) platforms such as SafeBreach,
  AttackIQ, Picus, Cymulate, Pentera, or SCYTHE to continuously validate endpoint,
  network, email-gateway, SIEM, and incident-response effectiveness by safely emulating
  MITRE ATT&CK techniques. Use when moving beyond point-in-time pentesting to continuous
  control validation, or standing up automated adversary emulation.
domain: cybersecurity
subdomain: vulnerability-management
tags:
- breach-attack-simulation
- bas
- security-validation
- safebreach
- attackiq
- picus
- cymulate
- mitre-attack
version: '1.0'
author: mahipal
license: Apache-2.0
d3fend_techniques:
- File Metadata Consistency Validation
- Application Protocol Command Analysis
- Identifier Analysis
- Content Format Conversion
- Message Analysis
nist_csf:
- ID.RA-01
- ID.RA-02
- ID.IM-02
- ID.RA-06
mitre_attack:
- T1190
- T1203
- T1068

Implementing Continuous Security Validation with BAS

Overview

Breach and Attack Simulation (BAS) is an automated, continuous approach to validating security control effectiveness by safely executing real-world attack techniques against production security infrastructure. Unlike traditional penetration testing (point-in-time), BAS platforms continuously simulate threats mapped to MITRE ATT&CK, testing endpoint protection, network security, email gateways, SIEM detection, and incident response capabilities. Leading platforms include SafeBreach, AttackIQ, Picus Security (2024 Gartner Customers' Choice), Cymulate, Pentera, and SCYTHE. BAS 2.0 solutions safely emulate real attacker behavior across the entire IT environment without requiring pre-deployed agents on every endpoint.

When to Use

• When deploying or configuring implementing continuous security validation with bas capabilities in your environment
• When establishing security controls aligned to compliance requirements
• When building or improving security architecture for this domain
• When conducting security assessments that require this implementation

Prerequisites

• BAS platform license (SafeBreach, AttackIQ, Picus, Cymulate, or Pentera)
• Deployed security controls to validate (EDR, NGFW, email gateway, SIEM, WAF)
• MITRE ATT&CK framework familiarity
• Network segments accessible by BAS agents/simulators
• Security operations team to act on validation results
• Change management approval for running simulations in production

Core Concepts

BAS vs Traditional Security Testing

MITRE ATT&CK Coverage Mapping

Security Control Validation Score

Control Effectiveness = (Attacks Prevented + Attacks Detected) / Total Attacks Simulated * 100

Example:
  Total simulations:  500
  Prevented (blocked): 350
  Detected (alerted):  100
  Missed (no action):   50

  Prevention Rate: 350/500 = 70%
  Detection Rate:  100/500 = 20%
  Overall Score:   450/500 = 90%
  Gap Rate:         50/500 = 10%

Workflow

Step 1: Deploy BAS Platform Components

Architecture:
  Management Console (Cloud SaaS):
    - Central orchestration and reporting
    - Attack scenario library management
    - MITRE ATT&CK mapping dashboard

  Simulation Agents:
    - Attacker Agent: Simulates threat actor behavior
    - Target Agent: Receives simulated attacks
    - Network Agent: Tests network-level controls

  Deploy agents across zones:
    - Corporate network (workstations)
    - DMZ (web servers)
    - Data center (critical servers)
    - Cloud environments (AWS/Azure/GCP)
    - Remote/VPN segment

Step 2: Configure Attack Scenarios

# Example BAS scenario configuration
scenario:
  name: "APT29 (Cozy Bear) Full Kill Chain"
  threat_group: APT29
  mitre_attack_techniques:
    - T1566.001  # Spearphishing Attachment
    - T1059.001  # PowerShell Execution
    - T1547.001  # Registry Run Key Persistence
    - T1003.001  # LSASS Memory Credential Dump
    - T1021.002  # SMB/Windows Admin Shares
    - T1071.001  # Web Protocol C2
    - T1048.003  # DNS Exfiltration

  phases:
    - name: "Initial Access"
      actions:
        - deliver_phishing_payload:
            type: office_macro
            target: email_gateway
            variants: [docm, xlsm, ppam]

    - name: "Execution & Persistence"
      actions:
        - execute_powershell:
            encoded: true
            amsi_bypass: true
        - create_scheduled_task:
            technique: T1053.005

    - name: "Credential Access"
      actions:
        - dump_lsass:
            method: [procdump, comsvcs, nanodump]

    - name: "Lateral Movement"
      actions:
        - psexec_lateral:
            target: internal_server
        - wmi_lateral:
            target: file_server

    - name: "Exfiltration"
      actions:
        - dns_exfiltration:
            data_size: 10MB
            encoding: base64

Step 3: Map Results to Security Controls

def map_bas_results_to_controls(simulation_results):
    """Map BAS results to security control effectiveness."""
    control_scores = {}

    control_mapping = {
        "email_gateway": ["T1566.001", "T1566.002", "T1566.003"],
        "edr": ["T1059.001", "T1003.001", "T1055", "T1547.001"],
        "ngfw": ["T1071.001", "T1071.004", "T1048"],
        "siem": ["T1053.005", "T1021.002", "T1087"],
        "dlp": ["T1048.003", "T1567", "T1041"],
        "ndr": ["T1071", "T1021", "T1040"],
    }

    for control, techniques in control_mapping.items():
        relevant = [r for r in simulation_results
                    if r["technique_id"] in techniques]
        if not relevant:
            continue

        prevented = sum(1 for r in relevant if r["result"] == "prevented")
        detected = sum(1 for r in relevant if r["result"] == "detected")
        missed = sum(1 for r in relevant if r["result"] == "missed")
        total = len(relevant)

        control_scores[control] = {
            "total_tests": total,
            "prevented": prevented,
            "detected": detected,
            "missed": missed,
            "prevention_rate": round(prevented / total * 100, 1),
            "detection_rate": round(detected / total * 100, 1),
            "effectiveness": round((prevented + detected) / total * 100, 1),
        }

    return control_scores

Step 4: Schedule Continuous Validation

Validation Schedule:
  Daily:
    - Malware delivery simulation (email gateway test)
    - C2 communication simulation (firewall/proxy test)
    - Known ransomware behavior simulation (EDR test)

  Weekly:
    - Full kill chain simulation (APT scenario)
    - Lateral movement simulation (network segmentation test)
    - Data exfiltration simulation (DLP test)

  Monthly:
    - Full MITRE ATT&CK coverage assessment
    - New threat group TTP simulation
    - Regression testing after security control changes

  On-Demand:
    - After firewall rule changes
    - After EDR policy updates
    - After new threat intelligence (zero-day response)

Best Practices

1. Start with known threat group simulations relevant to your industry
2. Always run simulations in safe mode first before enabling full emulation
3. Coordinate with SOC team so they can distinguish BAS traffic from real attacks
4. Use BAS results to prioritize SIEM detection rule development
5. Track control effectiveness scores over time to demonstrate security posture improvement
6. Integrate BAS with ticketing systems to auto-generate remediation tickets for gaps
7. Run validation after every security control change to catch regressions
8. Map all simulations to MITRE ATT&CK for standardized reporting

Common Pitfalls

• Running BAS without informing the SOC, causing unnecessary incident response
• Testing only prevention and ignoring detection/response validation
• Not acting on BAS findings, leading to persistent security gaps
• Deploying BAS agents only in one network zone, missing cross-zone gaps
• Focusing only on commodity threats instead of APT-relevant scenarios
• Treating BAS as a replacement for penetration testing rather than a complement

Related Skills

• implementing-attack-path-analysis-with-xm-cyber
• performing-purple-team-exercise
• implementing-siem-use-cases-for-detection
• implementing-threat-modeling-with-mitre-attack

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

assets/template.md (verbatim)

BAS Security Validation Report Template

Validation Summary

Control Effectiveness Scores

Top Security Gaps

references/api-reference.md (verbatim)

API Reference: Breach and Attack Simulation Agent

Dependencies

CLI Usage

python scripts/agent.py \
  --target 10.0.1.50 \
  --siem-url https://siem.example.com \
  --siem-key YOUR_KEY \
  --output-dir /reports/

Functions

simulate_technique(technique, target) -> dict

Simulates a MITRE ATT&CK technique and records detection/blocked status.

check_siem_detection(siem_url, api_key, technique_id, time_window) -> dict

Queries SIEM API for alerts matching the simulated technique within time window.

compute_detection_coverage(results) -> dict

Calculates overall detection rate and per-tactic coverage breakdown.

generate_report(target, siem_url, siem_key) -> dict

Runs 7 ATT&CK technique simulations and generates detection gap report.

ATT&CK Techniques Tested

Output Schema

{
  "coverage": {"total_tests": 7, "detected": 5, "missed": 2, "detection_rate_pct": 71.4},
  "gaps": [{"technique_id": "T1003.001", "technique_name": "LSASS Memory"}],
  "recommendations": ["Create detection rule for T1003.001"]
}

references/standards.md (verbatim)

Standards and References - Continuous Security Validation with BAS

BAS Platforms

• SafeBreach: https://www.safebreach.com/
• AttackIQ: https://www.attackiq.com/
• Picus Security: https://www.picussecurity.com/
• Cymulate: https://cymulate.com/
• Pentera: https://pentera.io/
• SCYTHE: https://scythe.io/

Industry Standards

• MITRE ATT&CK Framework: https://attack.mitre.org/
• Gartner BAS Market Guide: Breach and Attack Simulation Tools
• NIST CSF 2.0 DE.CM: Security Continuous Monitoring
• CIS Controls v8.1 Control 18: Penetration Testing

Gartner Recognition (2024)

• Picus Security: 2024 Customers' Choice for BAS Tools
• Category evolution: BAS -> Adversarial Exposure Validation (2025)

Key Metrics

references/workflows.md (verbatim)

Workflows - BAS Continuous Security Validation

Workflow 1: BAS Validation Cycle

┌──────────────┐   ┌──────────────┐   ┌──────────────┐   ┌──────────────┐
│ Select Attack│──>│ Execute Safe │──>│ Collect      │──>│ Map to       │
│ Scenarios    │   │ Simulation   │   │ Results      │   │ Controls     │
└──────────────┘   └──────────────┘   └──────────────┘   └──────────────┘
                                                                  │
       ┌─────────────────────────────────────────────────────────┘
       v
┌──────────────┐   ┌──────────────┐   ┌──────────────┐
│ Identify     │──>│ Create       │──>│ Re-Validate  │
│ Control Gaps │   │ Remediation  │   │ After Fix    │
└──────────────┘   └──────────────┘   └──────────────┘

Workflow 2: Post-Change Regression Test

Security Control Change (firewall rule, EDR policy, SIEM rule)
    │
    v
Trigger BAS regression test for affected technique categories
    │
    v
Compare results: before vs after change
    │
    ├── Improvement: Document and close
    └── Regression: Alert security team, rollback if needed

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.