Adversary emulation deliberately plays out an attacker's playbook against your own defences to find detection gaps before a real attacker does.
P(detected) = sensitivity * (1 - stealth)
MITRE ATT&CK-style lateral movement
- Network hosts — simulated endpoints in the emulated corporate network.
- Detection coverage — fraction of hosts instrumented with active detection telemetry.
- Attacker stealth — how well the emulated adversary evades logging and alerting per hop.
- Detection sensitivity — how aggressively defenders flag suspicious lateral movement.
Red-team adversary emulation exercises like this are how real security teams validate detection coverage against MITRE ATT&CK techniques before a real breach tests it for them.