MITRE Caldera

Overview

MITRE Caldera is a free, open-source framework for automating adversary emulation and cybersecurity assessments. It is best for security teams prepared to run their own environment and tailor exercises around ATT&CK. Its extensible design is a strong fit for structured testing, but its security posture and Docker constraints require planning.

Key features

Caldera’s core pairs an asynchronous command-and-control server with a REST API and web interface; plugins add capabilities without changing that basic architecture. Teams can use it for autonomous emulation, manual red-team engagements, detection and response testing, or red-versus-blue research. ATT&CK-based adversary profiles give exercises a recognizable structure for testing defenses and training blue teams, while custom scenarios allow teams to target their own objectives.

The default Sandcat agent is written in Go and supports cross-platform deployment, beaconing, instruction execution, payload downloads, and file uploads. The Atomic plugin imports tests from the open-source Red Canary Atomic tests repository, making those tests usable within Caldera. Team-maintained plugins add Atomic Red Team TTPs, ATT&CK visualizations, incident response, reporting, and training. Caldera for OT adds protocol-specific abilities for common industrial protocols, extending its use to industrial environments.

Those capabilities cover hosts, networks, endpoint security, and OT environments. The trade-off is operational: installation is documented from source or through full and slim Docker containers, but the Builder plugin does not work in Docker and container data is ephemeral by default. Teams relying on either Builder or retained container state should account for those limits before choosing a deployment path.

Pricing

Apache Caldera — free. The open-source framework is available under the Apache License 2.0, with no trial required. There are no paid tiers described; teams gain the framework without a license fee, but must provide the environment and operational work needed to run it.

Caldera is an on-premises deployment. The repository recommends Linux or macOS, Python 3.10 or later with pip, and at least 8 GB RAM and 2 CPUs for the core framework. These requirements make it a more natural choice for teams with suitable infrastructure and Python familiarity than for users seeking a managed, low-maintenance service.

Platforms

Caldera supports API, Linux, macOS, self-hosted, and web environments. Its documented source and Docker deployment options offer flexibility, but neither removes the need to plan host resources, secure the network, and address Docker’s Builder and persistence limitations.

Who it's for

Caldera suits security teams conducting recurring emulation, manual red-team work, detection and response platform testing, or blue-team training. Its ATT&CK mapping, custom scenarios, and plugin range are particularly useful when exercises need to cover multiple surfaces, including OT. It is less appropriate for organizations that need a hardened interface or want a vendor-managed deployment: the project recommends a secure environment or network and says the web interface has only basic security features, is not hardened, and has not been thoroughly penetration-tested.

Authentication can use Caldera’s internal user mapping or LDAP, and configuration can specify a custom login handler. Documentation, training, use cases, tutorial videos, a blog, Discord, and GitHub discussions provide routes for learning and community support, though teams still own deployment and security decisions.

Pros and cons

Pros

• Broad exercise design: ATT&CK mapping and custom scenarios support structured testing tailored to a team’s defenses.
• Extensible coverage: Plugins span Atomic tests, OT protocols, visualization, incident response, reporting, and training, making the framework relevant across several security workflows.
• Open-source and on-premises: The Apache-licensed framework can be run in an organization’s own environment without a software license charge.

Cons

• Security needs active management: The web interface is not hardened and has only basic security features, so Caldera should run in a deliberately secured environment or network.
• Docker has practical caveats: Builder does not work in Docker, and container data is ephemeral by default, complicating workflows that depend on either capability.
• Infrastructure is the user’s responsibility: The recommended host resources and source or container deployment make it a better match for teams able to operate their own security tooling.

Alternatives

Breach and Attack Simulation Software is a useful place to compare the broader category. Choose Atomic Red Team instead when a focused, community-developed collection of tests that run in five minutes or less with minimal setup is a better fit than Caldera’s broader framework. Infection Monkey is another free, open-source breach and attack simulation tool for teams considering a different self-hosted option.

OpenAEV may suit teams seeking a freemium alternative with a free-forever on-premises Community Edition for core attack simulation and tabletop exercises, backed by community support; it also offers a free trial. For commercial options, Pentera Platform, BlackNoise BAS, Cymulate Platform, and Keysight Eggplant Test are paid products. Cymulate and Eggplant Test offer free trials; Eggplant Test has no free plan.

Teams focused on a free, self-hosted Windows option can also consider PurpleSharp.

Verdict

Choose MITRE Caldera if your security team wants a free, extensible, ATT&CK-based platform for on-premises emulation across hosts, networks, endpoint security, or OT, and can manage its deployment securely. Its plugin ecosystem and custom scenarios are the main reasons to choose it. Look elsewhere if you need a hardened web interface, a managed service, or a Docker workflow that depends on Builder or persistent container data.