Atomic Red Team

Breach and Attack Simulation Software

Free planAPILinuxmacOSWindows

7.3#3 of 19Freefree plan

Overview

Atomic Red Team is a free library of tests security teams can run to check controls, validate visibility, and assess detection coverage. Its tests emulate adversary behaviors and map to the MITRE ATT&CK matrix. They have few dependencies and use a structured format suited to automation frameworks. Invoke-AtomicRedTeam is a PowerShell module for testing defenses against attack techniques; it can run tests locally or on remote machines through PowerShell Remoting. Atomic Runner can run a configurable list unattended, once per week by default. The project includes a Ruby API to validate tests and generate documentation, and pulls ATT&CK data in STIX form. Listed integrations include Microsoft Defender for Endpoint, AttackIQ, Datadog Workload Security Evaluator, OpenBAS, Splunk Attack Range, and Tidal Cyber. Coverage includes Windows, Linux, macOS, cloud infrastructure, containers, SaaS, Azure AD, Google Workspace, Office 365, and IaaS providers. Tests can be chained manually, but there is no automated solution for emulating a specific attack group as a whole. Users are instructed to obtain permission from the environment owner before running a test.

Who it is for

Atomic Red Team suits security teams validating visibility and detection against mapped attack techniques. It is intended for environments where the owner has authorized testing.

What is good

Free library of tests mapped to MITRE ATT&CK.
PowerShell module supports local and remote execution.
Atomic Runner can schedule unattended test runs.
Tests cover Windows, Linux, macOS, and cloud infrastructure.

What to know first

No automated solution emulates a specific attack group as a whole.
Specific attack-group scenarios require manually chaining tests.
Permission from the environment owner is required before execution.

Verdict

Atomic Red Team provides free, mapped tests and tools for repeated or automated control checks. It does not automate emulation of a whole attack group, and execution requires the environment owner's permission.

Atomic Red Team plans and pricing

All plans

Open-source project Free tests run in five minutes or less · minimal setup · community developed atomicredteam.io · 2 Oct 2026

Compared on breach and attack simulation software

Free plan: Yesatomicredteam.io
Included attack surfaces: Windows, Linux, macOS, cloud infrastructure, containers, SaaS, Azure AD, Google Workspace, Office 365, and IaaS providersatomicredteam.io
MITRE ATT&CK mapping: Yesatomicredteam.io
Custom attack scenarios: Yesatomicredteam.io
Continuous scheduling: Yesatomicredteam.io
Deployment model: on-premisesatomicredteam.io

Facts

Purpose: Atomic Red Team is a library of simple tests that security teams can execute to test their controls.atomicredteam.io · 2 Oct 2026
Detection validation: The project supports validating visibility, testing detection coverage, and emulating adversary behaviors.atomicredteam.io · 2 Oct 2026
ATT&CK mapping: Atomic tests are mapped to the MITRE ATT&CK matrix.atomicredteam.io · 2 Oct 2026
Test format: Tests have few dependencies and are defined in a structured format usable by automation frameworks.atomicredteam.io · 2 Oct 2026
Execution framework: Invoke-AtomicRedTeam is a PowerShell module for testing security controls and defenses against attack techniques.atomicredteam.io · 2 Oct 2026
Remote execution: Invoke-AtomicTest can run tests locally or on remote machines through PowerShell Remoting.atomicredteam.io · 2 Oct 2026
Continuous testing: Atomic Runner runs a configurable list of atomic tests unattended, once per week by default.atomicredteam.io · 2 Oct 2026
Ruby API: Atomic Red Team includes a Ruby API used to validate tests and generate documentation.atomicredteam.io · 2 Oct 2026
ATT&CK data API: The project pulls MITRE ATT&CK data using the STIX representation of ATT&CK.atomicredteam.io · 2 Oct 2026
Integrations: The project page lists integrations and products including Microsoft Defender for Endpoint, AttackIQ, Datadog Workload Security Evaluator, OpenBAS, Splunk Attack Range, and Tidal Cyber.atomicredteam.io · 2 Oct 2026
Cloud coverage: Atomic Red Team covers cloud infrastructure attacks through tests marked with iaas as a supported platform.atomicredteam.io · 2 Oct 2026
Operational limit: There is no automated solution for emulating a specific attack group as a whole; tests can be chained manually.atomicredteam.io · 2 Oct 2026
Security use requirement: Users are instructed to obtain permission from the environment owner before executing an atomic test.atomicredteam.io · 2 Oct 2026
Community support: The public Atomic Red Team Slack Workspace has an #atomic-git channel that posts notifications about new contributions.atomicredteam.io · 2 Oct 2026