Atomic Red Team
Atomic Red Team is a free library of security tests for checking whether security controls provide visibility and detect adversary behaviors.
What Atomic Red Team is
Atomic Red Team is a free library of security tests for checking whether security controls provide visibility and detect adversary behaviors. Its tests map to the MITRE ATT&CK matrix and use a structured format with few dependencies, making them usable with automation frameworks. The project includes Invoke-AtomicRedTeam, a PowerShell module that can run tests locally or on remote machines through PowerShell Remoting, and Atomic Runner, which can run a configurable list unattended once per week by default. A Ruby API helps validate tests and generate documentation, while an API pulls ATT&CK data in STIX format. Tests cover Windows, Linux, macOS, and cloud infrastructure, among other listed attack surfaces, and the project lists integrations such as Microsoft Defender for Endpoint, Splunk Attack Range, and AttackIQ. It is an on-premises project with a free plan. There is no automated way to emulate a particular attack group as a whole, though tests can be chained manually. Users should obtain permission from the environment owner before running tests.
Good
- Free plan for the open-source project
- Tests mapped to the MITRE ATT&CK matrix
- Runs tests locally or through PowerShell Remoting
- Atomic Runner supports unattended scheduled testing
- Tests cover cloud infrastructure and multiple platforms
Watch out
- No automated whole-group attack emulation
- Permission from the environment owner is required
Who it suits
It suits security teams that want to check detection coverage against ATT&CK techniques using structured tests. Teams seeking a complete automated emulation of a specific attack group should note that this is not provided.
Verdict
Atomic Red Team provides a free, ATT&CK-mapped library for testing security controls, with local and remote execution options. It supports repeatable testing, but does not automate emulation of an entire specific attack group.
Plans and prices
From Atomic Red Team's own pricing page, checked 2 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Open-source project | Free | tests run in five minutes or less · minimal setup · community developed |
The facts
Each one read from Atomic Red Team's own pages, with the date it was checked.
What it does
- ATT&CK data API
- The project pulls MITRE ATT&CK data using the STIX representation of ATT&CK.checked 2 Oct 2026
- Cloud coverage
- Atomic Red Team covers cloud infrastructure attacks through tests marked with iaas as a supported platform.checked 2 Oct 2026
- Community support
- The public Atomic Red Team Slack Workspace has an #atomic-git channel that posts notifications about new contributions.checked 2 Oct 2026
- Continuous testing
- Atomic Runner runs a configurable list of atomic tests unattended, once per week by default.checked 2 Oct 2026
- Detection validation
- The project supports validating visibility, testing detection coverage, and emulating adversary behaviors.checked 2 Oct 2026
- Execution framework
- Invoke-AtomicRedTeam is a PowerShell module for testing security controls and defenses against attack techniques.checked 2 Oct 2026
- Integrations
- The project page lists integrations and products including Microsoft Defender for Endpoint, AttackIQ, Datadog Workload Security Evaluator, OpenBAS, Splunk Attack Range, and Tidal Cyber.checked 2 Oct 2026
- Operational limit
- There is no automated solution for emulating a specific attack group as a whole; tests can be chained manually.checked 2 Oct 2026
- Purpose
- Atomic Red Team is a library of simple tests that security teams can execute to test their controls.checked 2 Oct 2026
- Remote execution
- Invoke-AtomicTest can run tests locally or on remote machines through PowerShell Remoting.checked 2 Oct 2026
- Ruby API
- Atomic Red Team includes a Ruby API used to validate tests and generate documentation.checked 2 Oct 2026
- Security use requirement
- Users are instructed to obtain permission from the environment owner before executing an atomic test.checked 2 Oct 2026
- Test format
- Tests have few dependencies and are defined in a structured format usable by automation frameworks.checked 2 Oct 2026
Where it runs
- ATT&CK mapping
- Atomic tests are mapped to the MITRE ATT&CK matrix.checked 2 Oct 2026
The full review of Atomic Red Team
Overview
Atomic Red Team is a collection of small security tests intended to help teams check what their defenses can see and whether detection coverage exists. Each test represents an adversary behavior and is mapped to the MITRE ATT&CK matrix, so teams can exercise controls against individual techniques.
The project combines the test library with utilities for executing, validating, and documenting tests. Its tests have few dependencies and use a structured format that automation frameworks can consume. Atomic Red Team does not automatically recreate a specific threat group’s full operation; teams can chain tests manually when they need a broader sequence.
Execution requires authorization: users are instructed to obtain permission from the owner of the environment before running a test.
Key features
- ATT&CK mapping: Tests align with the MITRE ATT&CK matrix and cover Windows, Linux, macOS, cloud infrastructure, containers, SaaS, Azure AD, Google Workspace, Office 365, and IaaS providers. Cloud infrastructure tests are marked with iaas as a supported platform.
- Automation-friendly tests: Tests use a structured format and have few dependencies, making them usable with automation frameworks.
- PowerShell execution: Invoke-AtomicRedTeam is a PowerShell module for testing security controls against attack techniques. Invoke-AtomicTest can execute tests locally or on remote machines through PowerShell Remoting.
- Scheduled runs: Atomic Runner executes a configurable list of tests unattended, with weekly runs as its default schedule.
- Ruby API and ATT&CK data: The Ruby API helps validate tests and generate documentation. The project obtains ATT&CK data in STIX representation.
- Integrations: Listed products include Microsoft Defender for Endpoint, AttackIQ, Datadog Workload Security Evaluator, OpenBAS, Splunk Attack Range, and Tidal Cyber.
- Community updates: The public Slack Workspace’s #atomic-git channel posts notifications about new contributions.
Custom attack scenarios are supported, but group-level emulation is not automated. A team seeking to represent a sequence of behaviors must assemble the tests itself.
Pricing
Atomic Red Team is an open-source project with a free plan listed as free. The listed plan includes tests that run in five minutes or less, minimal setup, and community development.
Platforms
Listed platforms are API, Linux, macOS, and Windows. The project also lists cloud infrastructure, containers, SaaS, Azure AD, Google Workspace, Office 365, and IaaS providers among its covered attack surfaces. Its deployment model is on-premises.
Who it's for
Atomic Red Team is suited to security teams that want to validate visibility, exercise detection coverage, or emulate individual adversary techniques. Its ATT&CK mapping and automation-friendly test format support structured control checks, while Invoke-AtomicTest offers local and remote execution options. Teams should be prepared to manage permissions and assemble multi-test scenarios manually.
Pros and cons
- Pros: Free access; tests mapped to MITRE ATT&CK; broad listed attack-surface coverage; support for scheduled execution; and tests designed for automation.
- Cons: It does not automatically emulate a whole specific attack group, and test execution requires permission from the environment owner.
Alternatives
For more options, browse Breach and Attack Simulation Software. Other listed alternatives include OpenAEV, Keysight Eggplant Test, Infection Monkey, Picus Security Platform, SCYTHE, BlackNoise BAS, Cymulate Platform, and PurpleSharp.
Verdict
Atomic Red Team offers a free, ATT&CK-mapped set of tests with execution and scheduling tools for teams checking their defensive visibility and detection coverage. Its scope is individual behaviors rather than automated, end-to-end emulation of a particular attack group. Teams that need that broader scenario must chain tests themselves and should establish authorization before execution.
Getting started
- Visit the Atomic Red Team website.
- Choose tests for a supported platform or attack surface.
- Use Invoke-AtomicRedTeam to test controls locally or through PowerShell Remoting.
- Configure Atomic Runner with a list of tests for unattended weekly runs, if needed.
- Obtain permission from the environment owner before executing tests.
Limits worth knowing
The free Open-source project plan is listed as free and describes tests that run in five minutes or less, with minimal setup and community development. There is no automated solution for emulating a specific attack group as a whole.
Questions
How much does Atomic Red Team cost?
The Open-source project plan is listed as free. The pricing model is free.
Which platforms does it support?
The listed platforms are API, Linux, macOS, and Windows. Attack surfaces also include cloud infrastructure, containers, SaaS, Azure AD, Google Workspace, Office 365, and IaaS providers.
Does Atomic Red Team map tests to MITRE ATT&CK?
Yes. Atomic tests are mapped to the MITRE ATT&CK matrix, and the project pulls ATT&CK data using its STIX representation.
Can tests run remotely or on a schedule?
Invoke-AtomicTest can run tests locally or on remote machines through PowerShell Remoting. Atomic Runner can run a configurable list unattended, once per week by default.
Is it open source, and where is it deployed?
It is listed as an open-source project with an on-premises deployment model.
Which integrations are listed?
The project lists Microsoft Defender for Endpoint, AttackIQ, Datadog Workload Security Evaluator, OpenBAS, Splunk Attack Range, and Tidal Cyber.
Alternatives to Atomic Red Team
- 1
AttackIQ Platform
Free planWebAPILinuxmacOS7.9From $4,995 a month - 2
Google Cloud Secret Manager
Free planWeb6.5From $0.02 a month - 3
MITRE Caldera
Free planWebAPILinuxmacOS6.3Free plan - 4
OpenAEV
Free planWebAPILinuxSelf-hosted6.3Free plan - 5
SafeBreach Validate
WebAPILinuxmacOS6.3 - 6
Infection Monkey
Free planWebLinuxSelf-hostedWindows6.2Free plan