Infection Monkey vs Skyhawk Security BAS

Infection Monkey is an open-source breach and attack simulation tool for checking data center resilience to perimeter breaches and internal server infection. Monkey Agent scans systems and simulates attack techniques, while Monkey Island Server provides a command-and-control web interface. The tool maps visible machines, accessible services, and possible routes through a network, then reports security issues the agents discover or exploit. It supports on-premises environments, containers, and public and private clouds. The documented AWS integration uses Systems Manager to run Infection Monkey on EC2 instances, and plugins can be installed, updated, removed, or uploaded through the Monkey Island interface. Internet access is not required; when available, it is used to check for updates and whether machines can reach the internet. The FAQ says sensitive data is encrypted in the Island database and sent to agents over HTTPS, and that first launch requires creating credentials for access to the server. It also says the tool avoids exploits or attacks that may affect target systems, including EternalBlue. The Free plan is free.

Skyhawk Security BAS is a cloud SaaS Breach and Attack Simulation platform for cloud security teams and MSSPs. It runs custom, agentless attack simulations against a digital twin of cloud architecture and security controls, which Skyhawk says avoids affecting production systems or people. Continuous rehearsals validate controls, improve detection accuracy, and help shape response playbooks; teams can also check automated responses before production deployment. Validated exposures are prioritized by the business value of the affected asset. Listed attack surfaces include identities and permissions, vulnerabilities, attack paths, and high-value cloud assets, with MITRE ATT&CK mapping, custom scenarios, and continuous scheduling. The platform supports AWS, Azure, and GCP through API-based integration. Findings can come from Wiz, AWS Inspector, GuardDuty, Macie, and Tenable. Jira and ServiceNow integrations support remediation tracking. Pricing is on request, with a free 30-day trial.