Digital Risk: Enterprises Need More Than Cyber Insurance
Threatonomics

Breach and Attack Simulations: A Proactive Approach to Loss Prevention 

These simple but informative tests are like having a pen tester in your back pocket.

by Justin shattuck , Chief Information Security Officer
Published

Today’s CISOs and risk managers need to see around corners to proactively reduce risks before they turn into losses. Increasingly, CISOs also answer directly to the board of directors. No matter how tight you think your controls are or how big your budget is, I promise you things are happening in your environment that you do not know about. 

After decades as a network and security engineer and helping clients at Resilience, I know that we cannot help clients avoid all threats, but we can make them resilient to material losses.  Unlike legacy insurance providers, we provide clients with cyber insurance and a security solution that uses real loss data and data collected through our engagements to help you make better decisions about reducing cyber risk. 

We do this through continuous engagement with our clients. Rather than checking in with you once a year with a huge questionnaire, we engage with our clients more frequently to better understand their environment and give them ongoing actionable insights they can use to improve their risk posture. 

And now, with the latest release of our Essential Solution for loss prevention and our Edge Solutions for cyber risk management, we are introducing Breach & Attack Simulations and our Cyber Risk Profile Builder to help organizations take a proactive stance on risk management.  

Breach & Attack Simulation is a simple way to gather vital information to improve your cyber resilience. You can easily run a realistic simulation of the threat actors’ tactics, techniques, and procedures (TTPs)  within your environment(s) securely to assess your internal security processes, test and validate your existing controls, identify misconfigurations, and further refine improvements to your security program. 

Every team I have worked with has learned something new through the process. It’s like running a free tabletop exercise as existing controls and processes are tested, providing an opportunity to review and understand if your program is performing as expected.

One Resilience client found that their firewall configuration was leaving assets exposed to the internet; another found an obfuscated variant of Mimikatz in their environment that Microsoft Defender had not discovered despite its known availability to threat actors. 

Yet another client was unaware that their EDR was misconfigured for a subset of their endpoints. However, they identified it by conducting proactive tests in their environment. These kinds of issues are not uncommon, but they may not be captured by systems or testing.

More about Breach and Attack Simulation (BAS)

Resilience Breach and Attack Simulations (BAS), powered by AttackIQ, are a proactive approach to cybersecurity assessment that involves simulating real-world cyber attacks to identify vulnerabilities and weaknesses in an organization’s defenses. Unlike traditional security assessments, BAS goes beyond theoretical evaluations by replicating the TTPs used by actual threat actors. By doing so, BAS provides valuable insights into an organization’s security posture and helps identify areas for improvement. 

Our BAS testing includes:

  • Baseline Tests validate the effectiveness of clients’ security controls against modern malicious tactics. Our Essential Solution provides access to up to four (4) security baseline tests to assess controls against modern threats.  These tests do not require elevated privileges and run within an isolated environment that is removed at the conclusion of the test:
    • Content Filter: The Content Filtering test suite includes scenarios designed to assess the effectiveness of security technologies responsible for inspecting web-based traffic originating from the internal network. 
    • Endpoint Antivirus: This assessment package includes a selection of scenarios designed to test anti-virus (AV) efficacy with common ransomware, malware, and virus samples. It also includes “hacker tools,” which commonly evade AV detection.
    • Endpoint EDR: Scenarios included in the EDR test suite include adversarial behaviors specifically designed to elicit a response from a behavior-based endpoint protection technology. 
    • NextGen Firewall: This assessment evaluates the NGFW’s ability to prevent breaches and detect advanced threats, provide comprehensive network visibility and contextual awareness, and enable secure networking and convergence.

By integrating BAS testing into our risk quantification models, we provide clients with a comprehensive approach to cybersecurity risk management that empowers them to strengthen their defenses, mitigate vulnerabilities, and minimize the impact of cyber threats on their operations.

Learn more about Breach and Attack Simulation 

Breach and Attack Simulations (BAS) are a valuable tool for cyber insurance professionals looking to enhance their clients’ cybersecurity resilience. Incorporating BAS into service offerings enables more precise risk assessments, promotes proactive loss prevention measures, and helps clients gain a competitive advantage in the market. 

To learn more about BAS and all the new feature updates for the Resilience Essential and Edge Solutions, sign up for our free webinar today.

You might also like

Understanding identity-based attacks and how to defend against them

Breaches used to be primarily carried out via software vulnerabilities: Companies would announce a flaw, take a while to fix it, and attackers would find their way into the system using those exploits. From there they might not only steal information and assets from their primary target, but would also use their access to jump […]

Get ready for threats both old and new in 2025

It’s prediction season and while no one can see into the future, we can definitely take some educated guesses. From increasingly severe ransomware attacks to deepfakes that deceive Fortune 500 companies, we’re keeping an eye out for some major events in 2025. And while many organizations are taking steps to beef up their defenses, the […]

Contrasting and comparing FAIR with the Resilience solution

As market awareness of cyber risk quantification grows, we frequently receive questions from clients and curious risk managers about FAIR (Factor Analysis of Information Risk)—what it is, whether it truly provides accurate cyber risk quantification, the effort needed to set it up and maintain, and more. Clients often ask us to compare the FAIR methodology […]

How does Resilience establish the probabilities presented in my LEC?

Managing risk successfully at any level requires an understanding of a concept called “probability.” As both an insurance company (risk transfer) and a cyber risk management company, Resilience relies on understanding probabilities to price our services and to guide our clients to greater levels of cyber resilience. As we often receive questions from our clients […]

Moving beyond heat maps for better risk management

Heat maps are among the most widely used—and debated—tools for risk managers worldwide to communicate risks in their registries or project portfolios. Despite their popularity, we advise leaders seeking transparency in discussing risk and value to avoid relying on them. What are heat maps? Risk managers often use heat maps (or risk matrices) to represent […]

Breaking Lemonade: Understanding Value at Risk

I talk a lot about value-at-risk among my colleagues, with our customers, and the broader market. Value-at-risk may be the single most important measure to grasp, without which one cannot accurately measure risk transfer, excess risk, risk acceptance, and return on controls. Yet, these are all important concepts that leadership in modern organizations need to […]