AttackIQ provides an outstanding Breach and Attack Simulation (BAS) environment. This allows us to continuously validate our security posture against real-wworld thereats. Operating it from both a user and administrator perspective is highly efficient, particularly when orchestrating simulations and validating controls across a mature Windows Server and endpoint infrastructure.

Generally easy to use and intuitive UI navigation. The analytics graphs are a bit confusing and not real helpful. Large library of scenarios and test assessments. They are quick to publish new scenarios based on current threat intel and known attack vectors. Event correlation with SIEM is not very well tuned or customizable. Would be much nicer if you were allowed to map more specific fields to what they call their Indicators of Compromise (IOC) fields. Event correlation with our EDR events were not very concise either. Agents have a way to go yet with maturing how you can customize them. There is a config.yaml file on the agent but you can't set all agent behavior attributes in the file, which seems odd since it is there, why not allow you to put all possible values in that config file. A good product but has a ways to go yet before it is great. They have however added functionality since my initial review and appear to continue to innovate.