Skip to content
SPECIFICTION
Get listed

MITRE Caldera

caldera.apache.org

Free plan WebmacOSLinuxAPISelf-hosted
Visit caldera.apache.org
Spec score 8.0 #4 of 20 in Breach and Attack Simulation Software

What it is

MITRE Caldera automates adversary emulation and routine cybersecurity assessments using the MITRE ATT&CK framework. Its listed uses include autonomous emulation, detection and response platform testing, manual red-team work, and red-versus-blue research. Adversary profiles can be used to exercise defenses and train blue teams. The core combines an asynchronous command-and-control server, a REST API, and a web interface; plugins add capabilities including Atomic Red Team techniques, operational technology support, ATT&CK visualizations, incident response, reporting, and training. Its default Sandcat agent is written in Go and supports cross-platform deployment, beaconing, instruction execution, payload downloads, and file uploads. Caldera is free, open source under Apache License 2.0, and intended for on-premises deployment. Installation is documented from source and through Docker, with full and slim container variants. The project lists Linux or macOS and Python 3.10 or later with pip as host requirements, and recommends at least 8 GB RAM and 2 CPUs for the core framework. It advises running Caldera in a secure environment or network because its web interface is not hardened or thoroughly penetration-tested.

Spec sheet

Purpose
Apache Caldera automates adversary emulation and routine cybersecurity assessments.Read 5 Oct 2026 · caldera.apache.org
Deployment
The project documents installation from source and Docker deployment, including full and slim container variants.Read 5 Oct 2026 · github.com
Integrations
The Atomic plugin imports tests from the open-source Red Canary Atomic tests repository.Read 5 Oct 2026 · caldera.readthedocs.io
Security
The project recommends running Caldera in a secure environment or network and says its web interface is not hardened or thoroughly penetration-tested and has only basic security features.Read 5 Oct 2026 · github.com
Agent
The default Sandcat agent is written in Go and supports cross-platform deployment, beaconing, instruction execution, payload downloads, and file uploads.Read 5 Oct 2026 · caldera.readthedocs.io
Architecture
The core includes an asynchronous command-and-control server, a REST API, and a web interface, with plugins that add functionality.Read 5 Oct 2026 · github.com
ATT&CK
Caldera is built on the MITRE ATT&CK framework and can use adversary profiles to test defenses and train blue teams.Read 5 Oct 2026 · caldera.apache.org
Authentication
Caldera supports login through its internal user mapping or LDAP, and its configuration can specify a custom login handler.Read 5 Oct 2026 · caldera.readthedocs.io
Host requirements
The repository lists Linux or macOS, Python 3.10 or later with pip, and recommends at least 8 GB RAM and 2 CPUs for the core framework.Read 5 Oct 2026 · github.com
Notable limits
The repository states that the Builder plugin does not work in Docker and that Caldera container data is ephemeral by default.Read 5 Oct 2026 · github.com
OT support
Caldera for OT plugins add support for common industrial protocols through collections of protocol-specific abilities.Read 5 Oct 2026 · caldera.readthedocs.io
Plugins
Team-maintained plugins include Atomic Red Team TTPs, Caldera for OT, ATT&CK visualizations, incident response, reporting, and training.Read 5 Oct 2026 · github.com
Support and learning
The project links to documentation, training, use cases, tutorial videos, a blog, Discord, and GitHub discussions.Read 5 Oct 2026 · github.com
Use cases
The project describes autonomous adversary emulation, detection and response platform testing, manual red-team engagements, and red-versus-blue research as use cases.Read 5 Oct 2026 · caldera.apache.org

Plans and prices

Apache Caldera Free Open-source cybersecurity framework · Apache License 2.0 Read 5 Oct 2026 · caldera.apache.org

Every MITRE Caldera plan and price →

Strong points and limits

Strong points

  • Free and open source under Apache License 2.0.
  • Built on the MITRE ATT&CK framework.
  • Includes a REST API and web interface.
  • Plugins cover OT, incident response, and training.
  • Supports source and Docker installation.

Limits

  • Web interface is not hardened or thoroughly penetration-tested.
  • Builder plugin does not work in Docker.
  • Container data is ephemeral by default.
  • Core framework recommends at least 8 GB RAM and 2 CPUs.

Who it suits

Caldera suits security teams and researchers conducting adversary emulation, assessment, or red-versus-blue work. It assumes on-premises deployment and a secure environment or network.

Verdict

Caldera offers a broad, plugin-based framework for ATT&CK-driven emulation and assessment. Its security caveat and Docker limitations matter when planning deployment.

Where Specifiction places it

Alternatives to MITRE CalderaAll alternatives →