Adversary Emulation
Represent a real adversary as a chain of ATT&CK-mapped abilities and run it end to end, so you can watch an intrusion unfold and see exactly where it is stopped.
Why it matters
Most security assessments check patch levels and control coverage. They rarely test the one thing that matters most: how your program holds up while an adversary is actively moving through your network.
Kestrel represents adversary behavior as a chain of ATT&CK-mapped abilities and executes it end to end — so you can watch a realistic intrusion unfold and see precisely where it is caught, and where it is not.
- Threat-group profiles. Start from curated profiles that mirror how known adversaries operate, or compose your own from individual abilities.
- Faithful to real TTPs. Abilities are modeled on documented techniques rather than synthetic tests, so results reflect genuine risk.
- Repeatable by design. Save an emulation, version it, and re-run it after every change to prove a fix actually held.
An emulation is built from three parts.
Small, composable pieces you can read, edit, and share.
Composable abilities
Each technique is a self-contained unit with its own payload, cleanup step, and success criteria.
Adversary profiles
Group abilities into a profile that represents how a specific actor tends to operate.
Bounded execution
Constrain an operation to specific hosts, subnets, and windows so testing always stays inside the lines.
A profile, read top to bottom.
Every profile is transparent. You can see exactly which techniques it will attempt and in what order — no black boxes, no surprises.
Where to go next
Put adversary emulation to work.
Run a curated profile against your own environment, with your own authorization, and see what your defenses do about it.