Best Breach and Attack Simulation Software in 2026
Updated
In short: Keysight Eggplant Test is ranked #1 of 19 as of 4 October 2026, ahead of OpenAEV and Atomic Red Team. The best-ranked option with a free plan is OpenAEV.
Breach and attack simulation tools let security teams examine defenses through simulated attack activity. Compare attack simulation modes and included attack surfaces, then consider whether custom attack scenarios or a scenario library suit the exercises you want to run. MITRE ATT&CK mapping and continuous scheduling are also listed, alongside deployment model and free-plan and paid-from details. Keysight Eggplant Test leads the entries, with OpenAEV and Atomic Red Team following; Picus Security Platform and SCYTHE are also near the top. Use these criteria to compare the listed approaches and decide which capabilities align with your security testing needs.
19 breach and attack simulation software ranked on what their makers publish — plans and prices, free tiers, platforms and the facts on their own pages.
#1 Keysight Eggplant Test Top pick · 7.6 
#2 OpenAEV Runner-up · 7.6 Free plan · Free
#3 Atomic Red Team Also great · 7.3 Free plan · Free- Free trial AndroidapiiOSLinuxmacOSWebWindows
- Attack simulation modes
- hybrid
- Included attack surfaces
- network, endpoint, email
- MITRE ATT&CK mapping
- Yes
RecognisedDocumentedPlatformsFree planFree trial - Free planFree trial apiLinuxself-hostedWeb
- Free plan
- Yes
- Attack simulation modes
- hybrid
- Included attack surfaces
- endpoints, asset groups, people, teams, network hosts, email, phishing landing pages, SMS, phone-based social engineering, media pressure, tabletop exercises
- MITRE ATT&CK mapping
- Yes
- Custom attack scenarios
- Yes
RecognisedDocumentedPlatformsFree planFree trial - Free plan apiLinuxmacOSWindows
- Free plan
- Yes
- Included attack surfaces
- Windows, Linux, macOS, cloud infrastructure, containers, SaaS, Azure AD, Google Workspace, Office 365, and IaaS providers
- MITRE ATT&CK mapping
- Yes
- Custom attack scenarios
- Yes
RecognisedDocumentedPlatformsFree planFree trial - Free trial apiLinuxmacOSself-hostedWebWindows
- Free plan
- No
- Attack simulation modes
- hybrid
- Included attack surfaces
- network, endpoint, email, web application, data exfiltration, URL filtering
- MITRE ATT&CK mapping
- Yes
- Custom attack scenarios
- Yes
RecognisedDocumentedPlatformsFree planFree trial - Free trial Linuxself-hostedWebWindows
- Free plan
- No
- Included attack surfaces
- Windows, macOS, Linux, cloud, OT/ICS
- MITRE ATT&CK mapping
- Yes
- Custom attack scenarios
- Yes
RecognisedDocumentedPlatformsFree planFree trial - Free trial apiLinuxmacOSWindows
- Free plan
- No
- Attack simulation modes
- agent-based
- Included attack surfaces
- endpoint, email, network, SIEM
- MITRE ATT&CK mapping
- Yes
RecognisedDocumentedPlatformsFree planFree trial - Free trial Web
- Attack simulation modes
- agentless
- Included attack surfaces
- Endpoint Security; Email Gateway; Web Gateway; Web Application Firewall; Phishing Awareness; Lateral Movement; Data Exfiltration; Full Kill Chain; APT; Immediate Threat Intelligence
- MITRE ATT&CK mapping
- Yes
- Custom attack scenarios
- Yes
RecognisedDocumentedPlatformsFree planFree trial - Free trial apiWeb
- Free plan
- No
- Attack simulation modes
- agentless
- Included attack surfaces
- cloud architecture, cloud security controls, identities and permissions, vulnerabilities, attack paths, high-value cloud assets
- MITRE ATT&CK mapping
- Yes
- Custom attack scenarios
- Yes
RecognisedDocumentedPlatformsFree planFree trial - self-hostedWeb
- Attack simulation modes
- agentless
- Included attack surfaces
- network, Windows, Linux, macOS, AWS, Microsoft Azure, Google Cloud
- MITRE ATT&CK mapping
- Yes
- Custom attack scenarios
- Yes
RecognisedDocumentedPlatformsFree planFree trial - WebWindowsLinux
- Free plan
- Yes
- Attack simulation modes
- agent-based
- Included attack surfaces
- local networks; internal servers; on-premises data centers; cloud-based data centers; open services
- Custom attack scenarios
- Yes
RecognisedDocumentedPlatformsFree planFree trial - WindowsmacOSLinux
- Attack simulation modes
- agentless
- Included attack surfaces
- AWS, Azure, GCP, Kubernetes, Amazon EKS, Entra ID
- MITRE ATT&CK mapping
- Yes
- Custom attack scenarios
- Yes
RecognisedDocumentedPlatformsFree planFree trial - WebLinuxmacOS
- Attack simulation modes
- agent-based
- Included attack surfaces
- hosts, networks, endpoint security, OT environments
- MITRE ATT&CK mapping
- Yes
- Custom attack scenarios
- Yes
RecognisedDocumentedPlatformsFree planFree trial - Web
- Attack simulation modes
- hybrid
- Included attack surfaces
- endpoint, network, cloud, web, application, email
- MITRE ATT&CK mapping
- Yes
- Custom attack scenarios
- Yes
RecognisedDocumentedPlatformsFree planFree trial - apiLinuxself-hostedWebWindows
- Attack simulation modes
- agentless
- Included attack surfaces
- internal networks, cloud environments, external attack surface, web applications, endpoints, servers, services, and network devices
- MITRE ATT&CK mapping
- Yes
RecognisedDocumentedPlatformsFree planFree trial - Web
- Attack simulation modes
- agent-based
- Included attack surfaces
- endpoint, email, WAF, network segmentation, SIEM, EDR, XDR, firewall, DLP
- MITRE ATT&CK mapping
- Yes
RecognisedDocumentedPlatformsFree planFree trial - Windows
- Free plan
- Yes
- Included attack surfaces
- execution, persistence, privilege escalation, credential access, lateral movement, discovery, defense evasion
- MITRE ATT&CK mapping
- Yes
- Custom attack scenarios
- Yes
RecognisedDocumentedPlatformsFree planFree trial -
- Free plan
- No
- Attack simulation modes
- agent-based
- Included attack surfaces
- Network; Windows Active Directory; IoT devices
- MITRE ATT&CK mapping
- Yes
- Custom attack scenarios
- Yes
RecognisedDocumentedPlatformsFree planFree trial - WebRecognisedDocumentedPlatformsFree planFree trial
- RecognisedDocumentedPlatformsFree planFree trial
Is your tool on this list?
Numbered spots on this list can be sponsored. They are labelled, and the editorial order and scores never change for payment.
Questions about this list
Which breach and attack simulation software is ranked first on Specifiction?
Keysight Eggplant Test is ranked #1 of 19 with a score of 7.6. OpenAEV is second and Atomic Red Team third.
How many of these have a free plan?
2 of the 19 on this page publish a free plan on their own pricing pages.
How is this list ranked?
Ranked on what each maker publishes, the fullest spec sheet first: how deeply the product is documented, the platforms it runs on, a free tier or trial to test it, and its standing. Paid placements never change a rank.