Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / Why CISOs Are Buying Breach and Attack Simulation Tools
Transcript
- Lucas: So you've got a firewall, an EDR, a cloud security posture manager — maybe a dozen tools in the stack. How do you know any of them actually work when a real attacker shows up? Luna: That's the question that keeps CISOs up at night. I mean, you can have all the fancy tech, but if it's misconfigured or a rule expired, you're wide open. Lucas: Right. And for years the answer was: hire a penetration testing firm once a year, get a report, fix the findings, feel good for a few months. But attackers don't operate on an annual cycle. They probe continuously. So a category called breach and attack simulation — BAS for short — has been growing fast. Luna: I've heard the term. It's basically automated red teaming, right? Software that simulates attacks against your own environment to find holes before the bad guys do. Lucas: Exactly. But it's more surgical than a red team. A red team might run a multi-week campaign with social engineering, physical access attempts, custom exploits. BAS tools are designed to run thousands of small, safe simulations — every day — against specific controls. They'll test: can this malware variant reach the endpoint? Does the EDR detect it? Is the firewall blocking the C2 domain? It's continuous validation. Luna: And this is different from vulnerability scanning, right? A vuln scanner tells you a server is missing a patch. BAS tells you whether that missing patch is actually exploitable in your network. Lucas: That's the key distinction. Vulnerability management tells you about potential weaknesses. BAS tells you about exploitable attack paths. It's the difference between knowing there's a crack in the foundation and knowing a burglar can actually get through it. Luna: So who's buying this? Is it mostly large enterprises or are mid-market companies getting in on it too? Lucas: It started in the Fortune 500, but it's moving downstream fast. Gartner predicted that by 2027, 40% of enterprises will use BAS tools, up from under 10% in 2024. That's a huge jump. The drivers are pretty clear: ransomware attacks keep getting worse, cyber insurance underwriters are demanding proof of controls, and CISOs need to show their boards that the security budget is actually working. Luna: That board reporting angle is interesting. A BAS tool can produce a dashboard that says 'we tested 10,000 attack scenarios last week and blocked 99.8%' — that's a lot more concrete than 'we have a firewall'. Lucas: Exactly. And that's one reason the market has seen major M&A activity. In early 2026, a private equity consortium acquired AttackIQ for roughly one point eight billion dollars. AttackIQ was one of the early leaders in BAS, founded by former NSA and DoD folks. That acquisition signaled that the category is mature enough for big bets. Luna: One point eight billion — that's serious money. Who were the other players in that space? Lucas: You've got Cymulate, SafeBreach, Picus Security, XM Cyber — though XM Cyber is more focused on attack path management. Microsoft also has a BAS capability built into its Defender for Office 365 and Azure. But the pure-play vendors have been growing because they're agnostic — they test across any vendor's tools, not just their own. Luna: That makes sense. If you're a CISO with a multi-vendor stack, you want a tool that checks everything, not just the Microsoft stack or the Palo Alto stack. Lucas: Right. And that's actually a big selling point. BAS platforms have integrations with dozens of security products — firewalls, EDR, email gateways, cloud workload protection, identity providers. They launch simulations that mimic real adversary tactics based on the MITRE ATT&CK framework, and then they measure whether each control detected or blocked the attack. Luna: Does it ever cause false alarms? I mean, if you're simulating a ransomware attack, you don't want to actually trigger your incident response team. Lucas: That's a legitimate concern, and the vendors have put a lot of work into making simulations safe. They use techniques like 'benign' malware — actual malicious code that's been modified so it can't cause damage — or they use indicators of compromise that are recognizable as tests. Most platforms also have a 'loud' mode that tags the simulation traffic so your SOC knows it's a drill. But yes, if you don't configure it properly, you can get some noise. Luna: So it's not a replacement for human red teams, but it augments them. You automate the repetitive checks, and the humans focus on the creative stuff. Lucas: That's the ideal. A red team might run a sophisticated attack once a quarter. BAS runs basic and intermediate attacks every night. When the red team shows up, they're testing the things that the automated simulations can't — novel zero-days, complex social engineering, physical breaches. But the day-to-day hygiene is validated by the machine. Luna: And if you're a smaller company that can't afford a full-time red team, BAS is basically your automated security tester that works 24/7. Lucas: Right, and that's where the market growth is coming from. But there's a catch. BAS is only as good as the simulation library. If the vendor hasn't modeled a particular attacker technique — say, a new ransomware variant that uses a novel propagation method — then your BAS might give you a clean bill of health while you're actually vulnerable. Luna: So it's not a silver bullet. You still need threat intelligence to know what's happening in the wild. Lucas: Exactly. And the best BAS vendors update their simulation content weekly or even daily based on real-world threat intelligence. But it's a constant arms race. One thing that's interesting: some CISOs are using BAS not just for security validation, but for compliance. For example, PCI DSS or SOC 2 auditors are starting to accept BAS results as evidence that controls are operating effectively, instead of just a screenshot of a configuration. Luna: That's a big shift. Auditors have traditionally wanted to see policy documents and manual evidence. If they start accepting automated continuous testing, that could save companies a lot of time. Lucas: It's happening slowly. The major audit firms have been piloting BAS integration. But it's not universal yet. Still, the direction is clear: security teams are moving from point-in-time assessments to continuous validation. And BAS is the tool that enables that. Luna: I want to ask about the cost. Is this something only large enterprises can afford, or is it becoming accessible? Lucas: Pricing varies. Enterprise licenses can run six figures annually, but most vendors now offer scaled-down versions for mid-market companies starting around twenty to thirty thousand dollars a year. There are even some open-source options like Caldera from MITRE, though they require more manual setup. The barrier to entry is dropping, especially with cloud-delivered BAS that doesn't require on-prem infrastructure. Luna: So if I'm a CISO at a company with maybe five hundred employees, I could realistically run a BAS pilot for under fifty grand? Lucas: Absolutely. And many vendors offer free trials or proof of concept engagements. The typical PoC runs for two to four weeks and simulates a few dozen attack scenarios. That's often enough to find critical gaps that the team didn't know about. I've talked to CISOs who said the PoC alone paid for itself by revealing a misconfigured cloud bucket or an unpatched server that was exposed. Luna: That reminds me — there was a case last year where a healthcare company used a BAS tool and found that their email security gateway wasn't detecting a specific phishing technique that had been used in recent attacks on other hospitals. They fixed it before they got hit. Lucas: That's exactly the use case. And it's not just about finding gaps — it's about proving that fixes work. After you apply a patch or change a firewall rule, you can rerun the simulation to confirm the gap is closed. That's something a traditional penetration test can't do on a daily basis. Luna: So it turns security from a reactive, episodic process into a continuous feedback loop. That's powerful. Lucas: It is. And it changes the conversation between the CISO and the board. Instead of saying 'we had no incidents this quarter' — which could mean the attackers just haven't been caught — you can say 'we ran 15,000 attack simulations and our defenses blocked 99.7%. Here are the three gaps we found and how we fixed them.' That's a much more credible story. Luna: But it also means the CISO needs to be comfortable with transparency. If the board sees that your detection rate dropped from 99.5% to 98% after a new tool was deployed, that could raise awkward questions. Lucas: True. But most CISOs I've talked to prefer that transparency. It builds trust. And it helps justify budget increases when you can show that a new tool improved your detection rate by two percentage points. BAS gives you the data to have that conversation. Luna: So what's the next evolution of BAS? Where is this technology going? Lucas: A few trends. One is integration with SOAR — security orchestration, automation, and response — so that when a BAS simulation finds a gap, it can automatically trigger a remediation workflow. Another is using AI to generate more sophisticated simulations that adapt to your network topology in real time. And some vendors are building 'purple team' modules that facilitate collaboration between red and blue teams. Luna: And I assume we'll see more BAS capabilities embedded directly into broader security platforms, like SIEMs or XDR. Lucas: Exactly. Microsoft and Palo Alto already have basic BAS features. Over time, it may become a standard component of any enterprise security suite, like vulnerability scanning is today. But the pure-play vendors will likely survive by offering deeper, more cross-platform validation. Luna: And for the listener who's not a CISO but works in IT or security operations — what's the one takeaway from this episode? Lucas: If your team isn't running some form of automated security validation on at least a weekly basis, you're essentially hoping that your controls work. And hope is not a strategy. Breach and attack simulation tools turn that hope into measurement. And the best part is, you can start small — a pilot, a few attack scenarios, see what you find. It's one of the highest roi security investments you can make in 2026.