Adversary emulation or penetration test: which one do you need?

A penetration test looks for weaknesses you can exploit. Adversary emulation tests whether your detection and response hold up against the behaviour of a specific attacker, usually described with MITRE ATT&CK. Choose a pentest to find holes, and emulation to test defenders.

What each one asks

Penetration test: can a skilled person break into this system or reach this data, and how?

Adversary emulation: if an attacker like group X targeted us, would we notice, and how far would they get?

Both involve authorised offensive work. The difference is the goal and the script.

How ATT&CK frames emulation

MITRE ATT&CK is a free knowledge base of adversary tactics and techniques based on real world observations. Tactics are goals such as Initial Access, Persistence or Exfiltration. Techniques are the methods used for each tactic, and many have sub techniques with identifiers such as T1595.001.

MITRE publishes adversary emulation plans. Per its page, they are built from public threat reports and ATT&CK, and describe how a specific adversary chains techniques. Red teams stick to the group's known techniques while varying the implementation. The page says the plans help defenders test networks and defenses, test products and environments, and build analytics for behaviours instead of specific indicators or tools. The APT3 plan is the example given, with a companion field manual that maps commands to ATT&CK.

Decision guide

Choose a penetration test when:

• You are launching or changing an application and want flaws found.
• A customer or auditor asks for an independent test of a system.
• You have not tested the target before.
• You have a defined scope and want a prioritised list of issues.

Choose adversary emulation when:

• You already run monitoring and want to know if it works.
• You want to improve detection of specific techniques.
• You have a security operations function that can respond.
• Basic hygiene is in place, so a test would not just find easy holes.

Many teams do the first for several years before the second makes sense.

What to agree before either

• Written scope and rules of engagement.
• Who knows about the test. Emulation often keeps the defenders unaware, so agree an escalation path in case real incident response starts.
• What counts as success. For a pentest, findings with evidence. For emulation, which techniques were detected, which were blocked, and how long it took to notice.
• How results turn into fixes, and who owns each.

Purple teaming as a middle path

If you want learning more than a score, run the emulation with defenders watching, step by step. Each technique is run, the team checks what the tools saw, and gaps become detection work on the spot. This trades realism for speed of improvement.

What neither will do

Neither replaces secure design, patching or threat modeling. A test shows what fails today. It does not tell you why the design allowed it.

Quick check

Sources

• MITRE ATT&CK
• MITRE ATT&CK adversary emulation plans

Last reviewed: 19 October 2026.