Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Security Teams Are Using Breach Simulation to Find Gaps
Transcript
- Lucas: So last week I was talking to the head of security at a mid-sized financial services firm — about a hundred and twenty million in revenue — and she told me something that stuck with me. Luna: What was that? Lucas: She said her team runs a full penetration test twice a year — and passes every time. But between those tests, they still get hit by phishing campaigns that slip through their email gateway. And she realized: the pen test tells you if you were secure on a specific Tuesday in February, but it tells you nothing about the other three hundred sixty three days. Luna: Right — so the gap isn't in the depth of testing, it's in the frequency. Lucas: Exactly. And that's the problem that a category called breach and attack simulation — BAS for short — is trying to solve. These are platforms that continuously run simulated attacks against your environment — phishing emails, malicious payloads, privilege escalation attempts — and they tell you in real time if your controls actually caught them. Luna: It's like a fire drill that runs every day instead of once a year. Lucas: That's a great way to put it. And a handful of listeners chip in monthly through buy me a coffee dot com slash fexingo to help keep this show ad-free and independent. That's literally what funds our ability to dig into topics like this — so if the conversation is useful for what you're building or running, that's the way to support it. Luna: Yeah, it's a small group already keeping it going, and it makes a real difference. Lucas: So back to BAS — the big players here include Cymulate, AttackIQ, and SafeBreach. Cymulate, for instance, raised a seventy million dollar Series C back in 2025. The market is growing fast because CISOs are under pressure to demonstrate due diligence. Insurance carriers now want proof that controls are working, not just that you bought them. Luna: And BAS gives you that continuous evidence. But how is it different from just running an automated vulnerability scanner? Lucas: Good question. A vulnerability scanner tells you what's theoretically exploitable — unpatched software, misconfigurations. BAS actually tries to exploit them. It launches real, albeit contained, attack chains. So instead of a report saying 'you have a critical CVE in your web server,' BAS says 'we successfully exfiltrated data from your HR database using that CVE.' It validates whether your prevention and detection controls actually stopped the attack path. Luna: So it's more about testing defense effectiveness than finding vulnerabilities. Lucas: Exactly. And that's why a lot of security teams are using it to support purple teaming — where the red team and blue team work together. BAS automates the red team's attacks and measures the blue team's response. The Cymulate platform, for example, has modules for email security, web gateway, endpoint detection, even cloud infrastructure. Luna: I've heard some skeptics say BAS is just marketing hype — that it can't replace a skilled human pen tester. Lucas: That's a fair critique. A human tester is going to find creative, multi-step attack paths that a simulation engine might not think of. But BAS isn't sold as a replacement — it's a supplement. The analogy I like is the difference between an annual physical and a continuous health monitor. The physical gives you deep insight, the monitor catches things between visits. Most mature security programs now use both. Luna: So what's a concrete example of BAS finding something a traditional pen test missed? Lucas: Let me use that same financial services firm. They deployed a BAS platform — I believe it was AttackIQ — and ran a simulation that sent a phishing email with a link to a credential harvesting page. Their email gateway flagged almost all of them. But the BAS detected that one user clicked through and entered credentials. And then it attempted to use those credentials to log into the VPN. The VPN allowed the login because multifactor authentication wasn't enforced for that user group — it was a misconfiguration. Luna: Wow — so the pen test never would have caught that because it wasn't testing the email to vpn chain. Lucas: Exactly. The pen test assumed the email gateway worked. BAS showed that even though the gateway worked most of the time, one slip could lead to a full network compromise because MFA was missing on a specific group. They fixed that within a week. Luna: And that's the kind of evidence that helps with cyber insurance renewals too. Lucas: Huge. I talked to a CISO at a manufacturing company who said their insurer now requires quarterly BAS testing as part of their policy terms. It's becoming a de facto standard. The company that doesn't run BAS is going to pay higher premiums or get denied coverage. Luna: What about the cost? Is this something only large enterprises can afford? Lucas: It's getting more accessible. Most BAS vendors offer tiered pricing based on the number of assets or users. SafeBreach, for instance, has a small business offering that starts around fifteen thousand dollars a year. Compare that to a single penetration test that can cost twenty to fifty grand — and you're getting continuous testing. The return on investment is pretty clear if you have any kind of compliance or insurance pressure. Luna: So what's the downside? What should a security team watch out for if they're evaluating BAS? Lucas: I'd say three things. First, noise. Some platforms generate a lot of alerts that require human triage — you need a team ready to respond. Second, scope limitations. BAS is great for known attack patterns, but it won't catch zero-day exploits or internal misuse. Third, integration complexity. To get the full picture, you need to feed BAS results into your SIEM or SOAR — and that takes engineering effort. Luna: So it's not a 'set it and forget it' tool. Lucas: Not at all. But for teams that are already running a security operations center, adding BAS is like adding a continuous quality check. It changes the conversation from 'did we pass the audit?' to 'are we secure right now?' And that's a shift worth making. Luna: I think the next frontier is integrating BAS with threat intelligence feeds so simulations reflect real-world adversary behavior in near real time. Lucas: Absolutely. Some vendors are already doing that — Cymulate has a threat intelligence module that ingests current indicators of compromise and builds simulations around them. So if there's a new ransomware strain being used in the wild, the platform can test your defenses against it within hours. Luna: That's the kind of agility that traditional security testing just can't match. Lucas: It's a shift in mindset. Instead of preparing for a test, you're always testing. And I think that's where the industry is heading — continuous validation, not point-in-time assurance.