I am currently looking for a proprietary Breach and Attack Simulation (BAS) solutions or open-source threat simulators to automatically test a wide range of attacks and malicious activities, perform security audits and find security gaps in a company to strengthen its defense.
I planned to make a market research about the existing attack and breach simulation solutions by comparing their features to know which one will best fit the requirements of the company.
I managed to make a comparison of open source threat simulators because there are scientific articles (such as Zilberman P., Puzis R., Bruskin S., Shwarz S. and Elovici Y., SoK: A Survey of Open-Source Threat Emulators, Polina Zilberman, 3 March 2020). The articles make useful comparison between the open-source threat simulators and explain the procedure and steps to make the right choice among the existing open-source threat simulator according to the company's environment, objectives, operations, etc.
However, when it comes to proprietary BAS solutions, it is more difficult to make a meaningful comparison as they are highly expensive, close source and do not provide detailed documentation. I have found a few websites that rank the best BAS platforms such as the following sites:
- https://roi4cio.com/catalog/en/products?categories=895
- https://www.comparitech.com/net-admin/best-bas-tools/
- https://www.esecurityplanet.com/products/breach-and-attack-simulation-bas-vendors/
- https://www.peerspot.com/categories/breach-and-attack-simulation-bas
- https://sourceforge.net/software/breach-and-attack-simulation-bas/
Based on these sites, I chose the following BAS vendors: SafeBreach, Picus Security, Cymulate, XM Cyber, AttackIQ, CyCognito. For each of them, a demo has been requested by putting in the user information like email address. Normally, I will get the demos for the next few days. Based on the demos, I hope it will be possible to compare the features of the different proprietary BAS products.
Does anyone know of any useful papers, articles, websites, posts or books that provide a detailed comparison or explanation of existing proprietary BAS solutions? Can anyone help me or advise me on how to obtain and search information about existing proprietary BAS solutions? In this way, it will be possible to choose the BAS solution that best suits the needs of the company.
Thank you very much,
Nicolas Gennart.