What is a threat emulation and how to read it

A threat emulation is a controlled simulation of a real attack run against an asset, designed to surface exploitable vulnerabilities under real-world conditions.

Unlike a traditional scan, it does not just flag potential weaknesses — it mimics attacker behavior to confirm whether the risk can actually be exploited.

What happens during a threat emulation?

When a threat emulation runs:

• The asset's context is analyzed

• Likely attack paths are mapped out

• Tests run sequentially and in parallel

• Findings are validated before being reported

👉 The whole process is automated, but follows the same offensive mindset a pentester would apply.

Real-time visualization

You can watch a threat emulation unfold in real time from the platform.

While it runs, you can see:

• Which actions are being performed

• Which endpoints or features are being targeted

• What decisions the agent is making

• How the testing progresses

👉 This gives you visibility not just into the outcome, but into the reasoning behind each finding.

💡 Execution control: a threat emulation can be paused or stopped at any time.

When paused, execution is put on hold but the capacity assigned to the asset stays reserved. This means the next run will be delayed and the slot won't be freed up.

Execution trace

Every threat emulation produces a trace — a step-by-step record of what happened during the run.

It covers:

• The sequence of actions performed

• The agent's decisions

• Tests executed

• Intermediate results

👉 The trace lets you retrace the exact path the agent took to uncover a vulnerability.

How it differs from a scan

Compared to traditional tools, the agent:

• Doesn't run tests blindly

• Doesn't generate unnecessary noise

• Focuses on paths most likely to be exploited

• Adapts its behavior to the context

👉 The result is more meaningful findings and fewer false positives.

Relationship with vulnerabilities

Reported vulnerabilities are the end product of a threat emulation.

👉 Every finding has been:

• executed

• validated

• confirmed as exploitable

That's what makes the results actionable.

Relationship with the asset

Threat emulations don't run in a vacuum. Within a given asset, the agent keeps building context over time.

👉 In practice, this means the agent:

• Connects findings across different runs

• Refines its strategy based on previous results

• Focuses on attack paths with the highest chance of success

👉 As the analysis on an asset evolves, testing becomes more efficient and goes deeper.

💡 This learning is specific to each asset and isn't shared across different ones.

Best practices

✔ Review the trace to understand the context behind a finding

✔ Use the real-time view for debugging

✔ Watch how testing shifts in response to changes

A threat emulation doesn't just tell you what's broken — it shows you how an attacker could actually exploit it, giving you real context to act on.