Atomic Red Team

Atomic Red Team is a free library of small, ATT&CK-mapped tests for security teams checking whether their controls can see and detect adversary behaviors. It suits teams that want repeatable checks they can run or automate, but not those seeking automatic emulation of a complete attack group.

Overview

Each test targets an individual behavior, giving defenders a practical way to probe visibility and detection coverage without treating a full adversary campaign as a single automated exercise. Teams can chain tests manually for broader sequences, but that requires their own planning and orchestration. The tests have few dependencies and use a structured format that automation frameworks can consume, making them more useful for repeatable control checks than one-off demonstrations.

Execution carries an important operational condition: users are instructed to obtain permission from the environment owner before running tests. That makes Atomic Red Team appropriate for authorized security work, not unsanctioned experimentation.

Key features

ATT&CK mapping and broad coverage: Tests map to the MITRE ATT&CK matrix and span Windows, Linux, macOS, cloud infrastructure, containers, SaaS, Azure AD, Google Workspace, Office 365, and IaaS providers. This gives teams a common framework for selecting behaviors to exercise across varied environments. Cloud infrastructure tests are marked with iaas as a supported platform.

PowerShell execution: Invoke-AtomicRedTeam is a PowerShell module for exercising controls against attack techniques. Invoke-AtomicTest can run tests locally or on remote machines through PowerShell Remoting, which suits teams that manage Windows environments through that mechanism.

Scheduled runs: Atomic Runner executes a configurable list of tests unattended, weekly by default. That supports recurring checks, though the default cadence and chosen test list still need to fit each team's validation needs.

Validation and documentation utilities: A Ruby API validates tests and generates documentation. The project also pulls MITRE ATT&CK data through its STIX representation, supporting its ATT&CK-oriented test framework.

Integrations: The project page names Microsoft Defender for Endpoint, AttackIQ, Datadog Workload Security Evaluator, OpenBAS, Splunk Attack Range, and Tidal Cyber among its integrations and products. These connections can help teams fit tests into existing security workflows.

Community contributions: The public Slack Workspace's #atomic-git channel posts new-contribution notifications, giving users a channel to follow project activity.

Pricing

The Open-source project plan costs nothing. It includes tests that run in five minutes or less, minimal setup, and community development. This is a strong fit for teams that can work within short test durations and want a no-cost way to build repeated or automated checks. The five-minute limit is a meaningful constraint for tests that need longer to run.

The plan is on-premises and covers a wide range of attack surfaces, including cloud infrastructure, containers, SaaS, Azure AD, Google Workspace, Office 365, and IaaS providers. Custom attack scenarios and continuous scheduling are supported. There is no paid tier described for Atomic Red Team.

Platforms

Atomic Red Team lists API, Linux, macOS, and Windows as platforms. Its attack-surface coverage also includes cloud infrastructure, containers, SaaS, and major workplace identity and productivity environments. Teams should distinguish that coverage from the execution tooling: remote test execution is specifically described through PowerShell Remoting.

Who it's for

Atomic Red Team is best for security teams that need a free, ATT&CK-aligned library for validating visibility and detection coverage, especially when they can select tests, authorize execution, and build their own routines around them. Its structured test format, remote PowerShell option, and weekly unattended runner make recurring checks possible. It is a weaker fit for organizations that need an automated, end-to-end emulation of a named attack group rather than individual behaviors.

Pros and cons

Pros

Free access to a broad test library: The free plan supports checks across many operating systems and attack surfaces.

Useful for repeatable validation: ATT&CK mapping, a structured format, and Atomic Runner support selecting and scheduling control checks.

Flexible execution options: Invoke-AtomicTest supports local and remote execution through PowerShell Remoting.

Cons

No automated whole-group emulation: Broader adversary sequences must be chained manually, so teams seeking turnkey campaign simulation should look elsewhere.

Short plan test duration: The free plan covers tests that run in five minutes or less, limiting its fit for longer checks.

Authorization is essential: Tests should only be run with environment-owner permission, which requires teams to establish approval before execution.

Alternatives

For a broader category comparison, see Breach and Attack Simulation Software.

Keysight Eggplant Test is a paid enterprise option with a free trial and platforms spanning Android, iOS, web, and desktop systems; consider it when those platform requirements matter.

OpenAEV offers a free forever, on-premises Community Edition with core attack simulation and tabletop exercises, making it an alternative for teams that want those capabilities in a self-hosted package.

AttackIQ Platform has a free tier with testing packages and adversary research, plus a $300, paid once pay-as-you-go plan; consider it when those packages or credit-based purchases suit your approach.

Picus Security Platform offers a 14-day free trial limited to one simulation agent and a ransomware-only threat library, which may suit a short, narrowly scoped evaluation.

Infection Monkey is a free, open-source breach and attack simulation tool for teams seeking a different no-cost option.

MITRE Caldera is a free framework under the Apache License 2.0 for teams comparing open-source cybersecurity frameworks.

SCYTHE is another alternative.

Valitrix BAS Platform is another alternative.

Verdict

Choose Atomic Red Team if your priority is free, mapped tests for recurring or automated checks of individual security controls and you can manage authorization and test selection. Look elsewhere if you need a system that automatically builds and runs a complete attack-group emulation.