# What is Adversary Emulation?

> Adversary emulation is the practice of reproducing a specific threat actor’s known tactics, techniques, and procedures to test whether defenses detect and stop that actor’s real behavior.

- Canonical URL: https://yellowcube.eu/glossary/adversary-emulation/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

Unlike generic penetration testing, emulation plans mirror documented adversary tradecraft — often mapped to MITRE ATT&CK — so results answer a sharper question: “Would we catch this particular adversary?” Emulation plans may come from threat intelligence, public libraries such as ATT&CK Evaluations or the Adversary Emulation Library, or internal analysis.

### Key points

- **Relevant adversary profiles:** Choose emulation profiles from actors known to target the organization’s sector and environment, not the most famous name.
- **Detection scoring:** Record which techniques were observed, alerted, and stopped — a missed early step matters even if the final objective was blocked.
- **Important limitation:** Emulation is a representation. Real adversaries adapt, combine techniques, and exploit conditions the plan did not model; passing an emulation does not mean surviving the actual actor.

### Related terms

[Red team](<https://yellowcube.eu/glossary/red-team/>) · [Breach and attack simulation (BAS)](<https://yellowcube.eu/glossary/breach-and-attack-simulation/>) · [MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge)](<https://yellowcube.eu/glossary/mitre-att-and-ck-adversarial-tactics-techniques-and-common-knowledge/>) · [Tactics, techniques, and procedures (TTPs)](<https://yellowcube.eu/glossary/tactics-techniques-and-procedures/>) · [Threat hunting](<https://yellowcube.eu/glossary/threat-hunting/>)

### Sources

[MITRE ATT&CK](https://attack.mitre.org/) · [NIST SP 800-115, Technical Guide to Information Security Testing and Assessment](https://csrc.nist.gov/pubs/sp/800/115/final)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.