Atomic Red Team

Atomic Red Team is a free library of security tests that teams can use to examine visibility, detection coverage, and defenses against adversary behaviors. Its tests are mapped to the MITRE ATT&CK matrix, use few dependencies, and follow a structured format suitable for automation frameworks. Invoke-AtomicRedTeam is a PowerShell module for running tests against security controls, either locally or on remote machines through PowerShell Remoting. Atomic Runner can run a configurable test list unattended, weekly by default. A Ruby API supports test validation and documentation generation, and the project obtains ATT&CK data in STIX format. Listed integrations include Microsoft Defender for Endpoint, AttackIQ, Datadog Workload Security Evaluator, OpenBAS, Splunk Attack Range, and Tidal Cyber. Coverage includes Windows, Linux, macOS, cloud infrastructure, containers, SaaS, Azure AD, Google Workspace, Office 365, and IaaS providers. Tests can be chained manually, but there is no automated way to emulate an entire specific attack group. Obtain permission from the environment owner before running a test.

Atomic Red Team offers a structured library of mapped tests, plus tools for local, remote, and unattended execution. It does not automate emulation of a whole specific attack group, and testing requires permission from the environment owner.

It suits security teams seeking mapped tests to assess detection coverage and validate visibility. Teams should have permission to test the environment and may need to chain tests manually for a broader scenario.

Overview

Atomic Red Team is a free, open-source project for security teams that want to check whether their controls expose and detect individual adversary techniques. It suits practitioners who need ATT&CK-mapped tests they can run or automate; it is less suited to teams seeking a ready-made simulation of an entire threat group.

Key features

Tests map to the MITRE ATT&CK matrix and span Windows, Linux, macOS, cloud infrastructure, containers, SaaS, Azure AD, Google Workspace, Office 365, and IaaS providers. Cloud infrastructure tests are marked with iaas as a supported platform. That breadth gives teams a way to assess controls across varied environments, while the focus remains on individual behaviors rather than end-to-end campaigns.

Tests have few dependencies and use a structured format that automation frameworks can consume. Invoke-AtomicRedTeam, a PowerShell module, runs tests against security controls and defenses; Invoke-AtomicTest can run them locally or on remote machines through PowerShell Remoting. This combination suits teams that want to incorporate discrete checks into existing workflows, but remote execution still depends on PowerShell Remoting.

Atomic Runner can run a configurable list of tests unattended, once per week by default. The Ruby API supports test validation and documentation generation, and the project uses the STIX representation of ATT&CK data. These tools help with recurring checks and upkeep, though they do not turn the library into automated, whole-group emulation: broader sequences must be chained manually.

The project page lists integrations including Microsoft Defender for Endpoint, AttackIQ, Datadog Workload Security Evaluator, OpenBAS, Splunk Attack Range, and Tidal Cyber. A public Slack workspace has an #atomic-git channel for new-contribution notifications. Anyone running a test should first obtain permission from the environment owner.

Pricing

Open-source project — free. The free plan includes tests designed to run in five minutes or less, minimal setup, and community development. There is no paid tier described here; teams should choose it for a no-cost, on-premises test library, not for a packaged managed service.

Platforms

Atomic Red Team supports API, Linux, macOS, and Windows. Its deployment model is on-premises, and its attack surfaces include cloud infrastructure and IaaS providers as well as containers and SaaS services.

Who it's for

This is a strong fit for security teams that want a free, ATT&CK-mapped way to validate visibility and detection coverage across different environments, especially when they can work with PowerShell, automation frameworks, or scheduled execution. Teams that need a specific adversary group's complete behavior reproduced automatically should look elsewhere; Atomic Red Team supports manual chaining, not automated group-level emulation.

Pros and cons

• Pro: Broadly mapped coverage. The tests span major operating systems, cloud, containers, and SaaS, giving teams a common ATT&CK framework for checking varied controls.
• Pro: Multiple execution paths. Local and remote PowerShell execution plus unattended weekly runs support both targeted checks and recurring validation.
• Pro: Free, automation-friendly tests. The structured format and few dependencies can ease integration into automation frameworks without a plan charge.
• Con: No automated full-group simulation. Teams must chain tests manually to build a broader sequence, which is a limitation for those seeking complete adversary emulation.
• Con: Authorization is essential. Tests should only be run with permission from the environment owner.

Alternatives

Breach and Attack Simulation Software is a broader category to explore when comparing this type of tooling.

Consider Keysight Eggplant Test if you need a paid enterprise option with a free trial and coverage across mobile, desktop, web, and API platforms; its pricing is by quote.

OpenAEV is another free-plan choice, with an on-premise Community Edition for core attack simulation and tabletop exercises, plus a free trial.

For a free, open-source breach and attack simulation tool, consider Infection Monkey.

MITRE Caldera offers a free cybersecurity framework under the Apache License 2.0.

BlackNoise BAS is a paid, self-hosted and web-based alternative.

Cymulate Platform is a paid web-based option with a free trial and subscription pricing tailored to the organization.

PurpleSharp is a free, self-hosted Windows alternative.

Pentera Platform is a paid option spanning API, Linux, self-hosted, web, and Windows, with commercial details provided through a personalized demo.

Verdict

Choose Atomic Red Team if your team wants a free, flexible library of ATT&CK-mapped tests for checking controls and detection coverage across on-premises systems and cloud-related attack surfaces. Its structured tests and execution tools are practical strengths; the decisive reason to look elsewhere is the need for automated, full threat-group emulation.