DTM™

Continuous Automated Red-Teaming

Automated adversary simulation and vulnerability discovery

AEGIS Platform Add-On Service
0
0
Total Exercises
0%
Attack Success Rate
0%
Detection Rate
0
0
Open Vulnerabilities
0
0
Critical Findings
CART Service Overview

The Continuous Automated Red-Teaming (CART) module is an enterprise add-on service to the AEGIS platform and DTM™ application. It provides automated adversary simulation, vulnerability discovery, and security posture validation through continuous testing.

Why Add CART?

  • Identify vulnerabilities before real adversaries do
  • Continuously validate security controls and detection capabilities
  • Simulate real-world attack scenarios aligned with MITRE ATT&CK
  • Measure and improve your organization's security posture over time
  • Automate red team testing without dedicated security teams
1
Create Attack Scenarios

What Are Attack Scenarios?

Attack scenarios are predefined threat playbooks that simulate real-world adversary tactics, techniques, and procedures (TTPs). They define the type of attacker, target sector, attack chain phases, and expected outcomes.

How to Create Scenarios:

  1. Navigate to the "Attack Scenarios" tab
  2. Click "New Scenario" to open the scenario builder
  3. Define scenario parameters:
    • Name: Descriptive scenario name (e.g., "Ransomware - Finance Sector")
    • Threat Actor: Nation state, cybercriminal, hacktivist, insider threat, etc.
    • Target Sector: Government, finance, healthcare, energy, etc.
    • Difficulty: Basic, intermediate, advanced, expert
  4. Build the attack chain using MITRE ATT&CK framework:
    • Initial Access → Execution → Persistence → Privilege Escalation
    • Defense Evasion → Credential Access → Discovery → Lateral Movement
    • Collection → Exfiltration → Impact
    • Assign MITRE technique IDs for each phase (e.g., T1566.001 - Phishing)
  5. Set success probability for each attack phase (0-100%)
  6. Define required resources and countermeasures
  7. Save the scenario for reuse in exercises

Tip: Start with pre-built scenarios from the library, then customize them for your environment. Common scenarios include ransomware attacks, APT campaigns, supply chain compromises, and insider threats.

2
Launch Red Team Exercises

What Are Red Team Exercises?

Red team exercises are simulated attacks executed against your systems using the defined scenarios. CART automates these exercises, runs them continuously, and measures your defenses' effectiveness.

How to Launch Exercises:

  1. Go to the "Exercises" tab
  2. Click "Launch Exercise" in the top-right
  3. Configure the exercise:
    • Select Scenario: Choose from your saved attack scenarios
    • Exercise Type: Penetration test, social engineering, physical security, supply chain, insider threat, or APT simulation
    • Target System: Specify which systems/networks to test
    • Attack Vectors: Email phishing, web exploits, network intrusion, etc.
    • Severity Level: Low, medium, high, critical
  4. Set schedule:
    • One-time: Run immediately or at scheduled date/time
    • Recurring: Daily, weekly, monthly automated testing
    • Continuous: Always-on adversary simulation
  5. Enable automation mode for AI-driven execution
  6. Start the exercise and monitor real-time progress

Important: Automated exercises run in sandboxed environments and do not disrupt production operations. They measure your detection/response capabilities without causing actual damage.

3
Monitor Exercise Execution

Real-Time Monitoring:

Track exercise progress and see how your defenses respond to simulated attacks in real-time.

What You'll See During Execution:

  • Exercise Status: Scheduled → In Progress → Completed/Failed/Paused
  • Attack Success Rate: Percentage of attack objectives achieved (0-100%)
  • Detection Rate: Percentage of attacks detected by your security controls
  • Mean Time to Detect (MTTD): How long it took to identify the attack
  • Attack Chain Progress: Which phase of the kill chain is executing
  • Live Findings: Vulnerabilities discovered as they're found
  • Execution Log: Detailed timeline of all attack actions and system responses

Key Metrics to Watch:

Attack Success Rate

Lower is better

Detection Rate

Higher is better

Mean Time to Detect

Lower is better

Critical Findings

Target: 0

4
Review and Remediate Vulnerabilities

Understanding Findings:

After each exercise, CART generates a detailed report of discovered vulnerabilities, security gaps, and recommendations.

How to Manage Vulnerabilities:

  1. Navigate to the "Vulnerabilities" tab
  2. Review findings by severity:
    • Critical: Immediate remediation required (exploit ready)
    • High: Remediate within 7 days
    • Medium: Remediate within 30 days
    • Low: Remediate within 90 days
  3. For each vulnerability, review:
    • Title and description
    • CVSS score and exploitability level
    • Affected systems
    • Proof of concept (how it was exploited)
    • Recommended remediation steps
  4. Assign vulnerabilities to security teams
  5. Set remediation deadlines based on severity
  6. Track status: Open → In Progress → Remediated → Verified
  7. Mark false positives or accepted risks with justification
  8. Re-run targeted exercises to verify fixes

Priority Action: Address all critical findings immediately. These represent actively exploitable vulnerabilities that could lead to full system compromise if discovered by real attackers.

5
Measure Security Posture Over Time

Track Improvement Metrics:

Use the Analytics tab to visualize your security posture trends and measure the effectiveness of remediation efforts.

Key Analytics:

  • Vulnerability Distribution: Breakdown by severity (Critical/High/Medium/Low)
  • Detection Capability Trend: How your detection rate improves over time
  • Attack Surface Risk: How successful attacks are against your defenses
  • Remediation Progress: Percentage of vulnerabilities fixed vs. open
  • Exercise History: Total exercises run and outcomes
  • MTTD Improvement: Reduction in mean time to detect attacks

Best Practices for Continuous Testing:

  1. Run exercises weekly to maintain visibility into your security posture
  2. Rotate scenarios to test different attack vectors and threat actors
  3. Increase difficulty progressively as defenses improve
  4. Verify all remediations with targeted re-tests
  5. Share findings with development and operations teams
  6. Update scenarios when new threats emerge (zero-days, new TTPs)
  7. Use findings to justify security investments and staffing

Success Indicator: Aim for 80%+ detection rate, sub-10-minute MTTD, and zero critical vulnerabilities remaining open.

6
Integration & Compliance Reporting

Export and Share Results:

Generate executive reports, compliance documentation, and technical briefings for stakeholders.

Reporting Features:

  • Executive summary dashboards for leadership
  • Technical findings reports for security teams
  • Compliance mappings (NIST CSF, ISO 27001, PCI-DSS, etc.)
  • MITRE ATT&CK coverage heatmaps
  • Remediation tracking and SLA reports
  • Trend analysis and risk scoring over time

Integration Capabilities:

  • SIEM integration for centralized security monitoring
  • Ticketing system integration (Jira, ServiceNow) for vulnerability tracking
  • Slack/Teams notifications for critical findings
  • API access for custom automation and reporting
Ready to Start Red Teaming?

CART is an enterprise add-on service. To enable continuous automated red-teaming for your AEGIS/DTM deployment:

  1. Contact your AEGIS platform administrator or account manager
  2. Review the CART service agreement and testing scope
  3. Complete initial setup and target system configuration
  4. Begin with pre-built scenarios and launch your first exercise (Step 1-2 above)