The Question
A mid-sized financial services firm has a mature vulnerability management program. Tenable.io scans the full environment on a weekly cadence. Findings are triaged by CVSS score. The highest-severity vulnerabilities are patched within the 30-day SLA most of the time. The security team has good hygiene metrics, acceptable board-level reporting, and — they believe — a defensible posture.
Then a red team engagement reveals that a chain of three medium-severity vulnerabilities, none of which would have breached the 30-day SLA individually, creates a direct lateral movement path from an internet-facing web server to the domain controller. The individual findings were not flagged as critical. The attack path they enabled absolutely was.
This is the specific problem that breach and attack simulation was built to address. Not vulnerability discovery — that is what VM does. Not external attack surface enumeration — that is what EASM does. BAS answers a more operationally precise question: given the vulnerabilities and misconfigurations that exist in this specific environment right now, which ones constitute attack paths that an adversary could actually traverse? The distinction matters because the answer is almost never the same as the list of highest-CVSS findings.
BAS is the CTEM validation stage operationalized — it transforms the question "is this vulnerability prioritized correctly?" into "is this vulnerability actually exploitable by an attacker in our environment right now?"
Why This Matters Now
In late 2024, a series of incidents involving healthcare organizations provided empirical evidence of the BAS gap. Threat actors affiliated with the ALPHV/BlackCat and LockBit ransomware groups executed attacks that specifically exploited the delta between what VM programs flagged as critical and what was actually exploitable in the live environment. Post-incident analysis, published in a joint CISA and HHS advisory in early 2025, found a consistent pattern: organizations had patched the highest-CVSS vulnerabilities on their critical systems, but had not validated whether compensating controls on medium-severity findings were actually functioning.
In several cases, a medium-severity CVE in a VPN concentrator was partially mitigated by a WAF rule — but the WAF rule had a syntax error introduced during a routine update that made it non-functional. The VM program showed the finding as "mitigated." The BAS platform, had any of these organizations been running one, would have discovered the control failure by attempting to exploit the path and succeeding.
The joint advisory specifically called out the absence of control validation — verifying that security controls are actually blocking the techniques they are configured to block — as a systemic gap in enterprise security programs. BAS is the primary technology solution to that specific gap. The healthcare sector was hit hardest in those incidents because it combines high-value data, complex legacy environments with many medium-severity findings, and historically under-resourced security operations teams. The validation gap is not unique to healthcare, but the consequences were most visible there.
What the CURVE™ Data Shows
The 2026 Stackcurve CTEM CURVE™ Report evaluated BAS platforms across four capability dimensions: network penetration simulation, kill chain simulation against MITRE ATT&CK, cloud security validation, and Active Directory attack simulation.
Pentera rated Tier 1 in network penetration and Active Directory validation. Its approach — autonomous, agent-based network pentesting that mimics actual attacker behavior — distinguishes it from script-based BAS platforms. AttackIQ rated Tier 1 in MITRE ATT&CK-aligned kill chain simulation, with the deepest ATT&CK coverage and the most mature integration with SIEM detection rule validation. Cymulate rated Tier 1 as a multi-vector BAS platform with the broadest scenario library across email, web, and network vectors. SafeBreach rated Tier 1 in control effectiveness measurement, with the strongest quantitative reporting on security control coverage gaps. Picus Security rated Tier 1 in detection and response validation, with particular strength in testing SIEM alert rules against simulated attack techniques.
In the cloud validation category, purpose-built CSPM platforms with BAS-adjacent capabilities — including Wiz and Orca — were evaluated alongside dedicated BAS tools, but none of the pure-play BAS vendors achieved Tier 1 ratings for cloud-native validation scenarios.
The full vendor rankings are in the 2026 Stackcurve CTEM CURVE™ Report — free to download.
The Gap Most Buyers Miss
BAS is frequently purchased as a point solution for compliance demonstration — "we ran a simulation, here are the results" — rather than integrated into the CTEM program as the validation stage that closes the loop between prioritization and remediation. The gaps most enterprises miss when deploying BAS are structural, not technical.
Gap 1: BAS Without Remediation Integration is a Report Generator
A BAS platform that runs simulations and produces findings that are not automatically fed into the remediation workflow has not added a validation stage to CTEM — it has added another findings list. The value of BAS in CTEM is that it answers the question "of the prioritized findings from VM and EASM, which ones have actually been closed and which ones still constitute exploitable paths?" That answer only becomes operationally useful if it automatically updates the finding status in the ITSM system, deprioritizes findings that are effectively mitigated by compensating controls, and escalates findings where remediation was believed complete but the path remains open.
Gap 2: False Positive Reduction is Underutilized
One of the most compelling uses of BAS that most enterprises deploy last rather than first: if the BAS platform cannot exploit a flagged vulnerability in the live environment because a compensating control actually blocks the technique, that finding can be legitimately deprioritized. This is not risk acceptance — it is evidence-based prioritization. It allows the remediation team to focus finite patching capacity on the vulnerabilities that represent real attack paths rather than theoretical ones. In large environments with tens of thousands of open findings, this capability alone can reduce the effective remediation queue by 20–40%.
Regression Testing After Remediation
The patch is applied. The ticket is closed. The finding moves to "remediated" in the VM dashboard. And six weeks later, a configuration change reopens the exposure. Without automated regression testing — running the BAS simulation against the specific path after remediation is confirmed — there is no mechanism to catch regression. BAS platforms that support automated re-validation after closure events address this gap; they should be configured to do so by default.
What BAS Cannot Do
BAS does not discover unknown vulnerabilities. It tests known technique coverage against known vulnerability classes. It cannot discover a novel zero-day, an undocumented attack path through a custom application, or the social engineering vector that a skilled human attacker would exploit. BAS is also not a substitute for threat modeling — it validates execution paths, not the threat model that informed which paths to validate. The most sophisticated red team engagements discover attack paths that no automated tool would generate because they combine technical, social, and physical vectors that fall outside any simulation library.
Questions Your Buying Team Should Be Asking
1. Does the platform support production-safe execution, and what specifically makes its simulations safe to run against live production environments?
This question is non-negotiable before any BAS deployment. A BAS platform that cannot articulate its production safety architecture — specifically, how it avoids causing service disruption, data exfiltration, or system instability during simulation — should not be running against production systems. Ask for the technical documentation on safe-mode constraints and reference customers who have run the platform continuously in production environments comparable to yours.
2. How does the platform integrate with our VM program to update finding status based on simulation results?
The answer should include a specific description of the API or native integration with your VM platform (Tenable, Qualys, or equivalent) and your ITSM system. If the integration pathway is "export a CSV and import it manually," that is an operational gap that will prevent the platform from functioning as a true CTEM validation stage.
3. What is the platform's coverage of the MITRE ATT&CK framework, and how frequently is the technique library updated?
ATT&CK coverage breadth is a meaningful differentiator in BAS platforms. Ask for a specific percentage of ATT&CK techniques covered and the update cadence when new techniques are added or existing ones are modified. A platform that hasn't updated its ATT&CK library in six months is not reflecting current threat actor behavior.
4. How does the platform handle Active Directory and identity attack simulation — specifically Kerberoasting, pass-the-hash, and DCSync?
Active Directory attack paths are present in a majority of ransomware and advanced threat actor incidents. AD simulation capability is a specific technical differentiator that separates BAS platforms designed for enterprise environments from those built primarily for perimeter and endpoint testing. Pentera and BloodHound Enterprise both have strong AD simulation capabilities; not all BAS vendors do.
5. Can the platform demonstrate control validation — specifically, testing whether our EDR and SIEM are detecting the techniques they claim to detect?
Control validation is distinct from vulnerability exploitation simulation. It tests whether your security tools — EDR policies, SIEM detection rules, network segmentation — are actually blocking the techniques they are configured to block. This is the capability that would have caught the WAF syntax error in the healthcare incidents described above. Ask for a live demonstration showing a simulated technique, the expected detection event, and a case where the control fails to fire.
The Stackcurve Take
BAS occupies a specific and irreplaceable position in the CTEM framework: it is the only technology that systematically answers whether prioritized findings are actually exploitable in the live environment without requiring a manual penetration test for each one. VM tells you what exists. EASM tells you what is exposed. TI tells you what is being targeted. BAS tells you what actually works against your defenses right now.
The enterprises that deploy BAS most effectively treat it as infrastructure, not a project. It runs continuously. Its results feed automatically into the remediation workflow. Regression testing is automated after every closure event. The security operations team uses BAS simulation results to calibrate their detection rules, not just to generate a compliance report.
The platforms that lead in this space — Pentera for network and AD simulation, AttackIQ and Cymulate for kill chain and multi-vector simulation, SafeBreach and Picus for control effectiveness measurement — are mature, production-safe, and well-integrated with the broader CTEM stack. The selection decision comes down to which simulation domain is most relevant to the enterprise's specific threat model and which integration pathway best fits the existing VM and ITSM environment.
The 2026 Stackcurve CTEM CURVE™ Report covers the full BAS vendor landscape including detailed capability scorecards, ATT&CK coverage benchmarks, and production deployment guidance. Download it free →
Stackcurve Advisory Briefs are independent research. No vendor pays for placement, tier assignment, or editorial influence. The CURVE™ methodology is disclosed in full at stackcurve.net/research/methodology.