AttackIQ Platform vs PurpleSharp
AttackIQ Platform
attackiq.comPurpleSharp
purplesharp.comSide by side
| Figure | AttackIQ Platform | PurpleSharp |
|---|---|---|
| Price from | $4,995/mo | — |
| Free plan | Yes | — |
| Free trial | Yes | — |
| Open source | — | — |
| Web | Yes | — |
| Windows | Yes | Yes |
| macOS | Yes | — |
| Linux | Yes | — |
| API | Yes | — |
| Self-hosted | Yes | Yes |
| Plans published | 9 | 0 |
| Spec score · Breach and Attack Simulation Software | 9.5 (#1) | 6.8 (#18) |
| License | The Enterprise agreement grants a limited, non-exclusive license and identifies the AttackIQ Solution and Content Library as AttackIQ proprietary property. | The GitHub README says the project is licensed under the BSD 3-Clause License. |
| Purpose | AttackIQ describes its platform as a CTEM platform for modeling adversary behavior, prioritizing attack paths, validating controls, and measuring security improvement. | PurpleSharp is an open-source C# adversary simulation tool for Windows Active Directory environments. |
| Support | AttackIQ offers customer support through its portal, email, phone, a private Slack channel, knowledge base, and blueprints. | The documentation thanks the community as a source of ideas and feedback and names Mauricio Velazco as an author. |
Plans
AttackIQ Platform
- Flex FreeFree
- FreeFree
- Flex Pay-as-you-go$300, paid once
- Pay-as-you-go$300, paid once
- Flex Monthly$4,995 a month
- Monthly$4,995 a month
- AttackIQ EnterprisePriced on request
- Flex YearlyPrice not published
- YearlyPriced on request
In their own words
AttackIQ Platform
AttackIQ Platform has no write-up on Specifiction yet; its figures are above.
PurpleSharp
PurpleSharp is a free, open-source C# adversary simulation tool for Windows Active Directory environments. It generates attack telemetry for detection teams building and testing analytics, checking detection resilience, locating visibility gaps, and identifying event-logging pipeline problems. Documentation maps 47 MITRE ATT&CK techniques across execution, persistence, privilege escalation, credential access, lateral movement, discovery, and defense evasion. JSON playbooks can combine techniques, define variations, and set technique-specific parameters. Local simulations run interactively after copying the PurpleSharp assembly to a host. Remote simulations use Windows SMB and RPC, requiring administrative credentials on the target plus network access to TCP ports 445 and 135. Scout tasks retrieve audit policy, event subscriptions, PowerShell logging settings, processes, and services. ATT&CK Navigator layers can be exported or imported as JSON playbooks. PurpleSharp is self-hosted on Windows, requires .NET Framework 4.5, and is licensed under BSD 3-Clause. The latest documented release is v1.3 from August 2021.