Atomic Red Team

Atomic Red Team is a library of ATT&CK-mapped security tests for checking detection coverage and visibility. It suits security teams that want to run individual adversary techniques across varied environments, especially where automation or integration with existing tools matters. Its main strength is focused, repeatable tests; it is not a turnkey simulation of a complete threat group.

Overview

The project pairs a collection of tests with tools for running, validating, and documenting them. Because tests have few dependencies and use a structured format, teams can incorporate them into automation frameworks rather than treating each exercise as a one-off. The ATT&CK mapping gives the tests a useful frame for examining which behaviors defenses can detect.

That focus on individual techniques is also a boundary: there is no automated way to emulate a specific attack group end to end. Teams can chain tests manually, but that takes planning and does not provide an automated group-level scenario. Execution also requires permission from the owner of the environment.

Key features

• ATT&CK-mapped coverage: Tests span Windows, Linux, macOS, cloud infrastructure, containers, SaaS, Azure AD, Google Workspace, Office 365, and IaaS providers. This broad surface gives teams a way to exercise controls beyond conventional endpoints, while still requiring them to choose and run relevant tests.
• PowerShell execution: Invoke-AtomicRedTeam is a PowerShell module for testing controls against attack techniques. Invoke-AtomicTest can run tests locally or on remote machines through PowerShell Remoting, which suits teams managing Windows environments across multiple hosts.
• Scheduled runs: Atomic Runner executes a configurable list of tests unattended, weekly by default. This can support recurring checks without a person launching each test, though the schedule and test list need to fit the environment.
• Validation and data tools: A Ruby API supports test validation and documentation generation, and the project retrieves ATT&CK data in STIX format. These components make the library more useful in workflows that maintain or automate tests.
• Integrations and community: The project lists integrations including Microsoft Defender for Endpoint, AttackIQ, Datadog Workload Security Evaluator, OpenBAS, Splunk Attack Range, and Tidal Cyber. Its public Slack workspace has an #atomic-git channel for new-contribution notifications.

Pricing

Open-source project — free. The free plan includes tests that run in five minutes or less, require minimal setup, and are community-developed. It covers the listed attack surfaces, supports custom attack scenarios and continuous scheduling, and is deployed on-premises. There are no paid tiers or seat and quota terms in this plan; its practical trade-off is the short test-duration limit and the need for teams to select, authorize, and operate the tests themselves.

Platforms

Atomic Red Team supports API, Linux, macOS, and Windows. Its attack-surface coverage also includes cloud infrastructure, containers, SaaS, Azure AD, Google Workspace, Office 365, and IaaS providers. The deployment model is on-premises, making it a fit for teams that want tests run within their own environments rather than through a hosted service.

Who it's for

It is a strong fit for security teams validating visibility and detection coverage against specific ATT&CK techniques, particularly those able to use PowerShell, schedule recurring runs, or connect the tests to automation and security products. It is less suitable for teams seeking an automated, full-operation adversary simulation or a managed testing service; Atomic Red Team supplies tests and execution tools, not a complete attack-group campaign.

Pros and cons

• Pros: Free access, broad platform and workload coverage, ATT&CK mapping, and a structured low-dependency test format support repeatable control checks across varied environments.
• Pros: Local and remote execution plus weekly unattended scheduling can make recurring validation practical for teams with the right operational setup.
• Cons: The five-minute test limit rules out longer-running tests under the free plan.
• Cons: Full attack-group emulation is not automated, so broader scenarios require manual chaining.
• Cons: Tests must not be run without the environment owner's permission, which makes authorization an essential operational prerequisite.

Alternatives

For a broader starting point, browse Breach and Attack Simulation Software.

• OpenAEV is worth considering when a freemium option with a free-forever on-premise Community Edition, core attack simulation, tabletop exercises, and community support better matches the need.
• Infection Monkey is another free option for teams looking at a web, Windows, and Linux platform.
• PurpleSharp is a free alternative focused on Windows.
• BlackNoise BAS is a paid alternative for teams seeking a self-hosted or web option.
• Cymulate Platform is a paid web option with a free trial and subscription pricing tailored to the organization.
• Keysight Eggplant Test is a paid enterprise option with a free trial and a broad platform range.
• Stratus Red Team is another free option for Windows, macOS, and Linux.
• MITRE Caldera is a free alternative for web, Linux, and macOS.

Verdict

Choose Atomic Red Team if you want a free, ATT&CK-mapped library for recurring, targeted validation across endpoints and cloud workloads. Its combination of structured tests, local or remote execution, and scheduling is compelling for teams prepared to manage their own exercises. Look elsewhere if you need a system that automatically reproduces a full threat group's operation.