MITRE Caldera

Overview

MITRE Caldera is a free, open-source framework for automating adversary emulation and routine cybersecurity assessments. It is best suited to security teams that can operate their own environment and want to tailor ATT&CK-based exercises. Its extensibility is valuable, but deployment requirements and basic web-interface security call for care.

Key features

Caldera combines an asynchronous command-and-control server, a REST API and a web interface, with plugins adding functionality. That foundation supports autonomous emulation, manual red-team engagements, detection and response testing, and red-versus-blue research. Adversary profiles based on MITRE ATT&CK give teams a framework for testing defenses and training blue teams; custom scenarios let them shape exercises around their needs.

The default Sandcat agent is written in Go and supports cross-platform deployment, beaconing, instruction execution, payload downloads and file uploads. The Atomic plugin imports tests from the open-source Red Canary Atomic tests repository, connecting Caldera exercises to that collection. Team-maintained plugins cover Atomic Red Team TTPs, ATT&CK visualizations, incident response, reporting and training. Caldera for OT adds protocol-specific abilities for common industrial protocols, extending its relevance to industrial environments.

The framework covers hosts, networks, endpoint security and OT environments, with agent-based simulation and on-premises deployment. Source installation and Docker deployment are documented, with full and slim container variants. Docker has a meaningful limitation: the Builder plugin does not work in containers, and container data is ephemeral by default. Teams should also account for the stated host needs: Linux or macOS, Python 3.10 or later with pip, and at least 8 GB of RAM and 2 CPUs recommended for the core framework.

Caldera supports authentication through internal user mapping or LDAP, and configuration can specify a custom login handler. That flexibility does not make the interface hardened: the project recommends a secure environment or network and cautions that the web interface has only basic security features and has not been thoroughly penetration-tested. Documentation, training, tutorials, use cases, a blog, Discord and GitHub discussions offer several routes to learning and community support.

Pricing

Apache Caldera costs nothing under the Apache License 2.0. The open-source framework is free to use, with no trial distinction or paid tier described. Its value is strongest for teams able to handle deployment and operation themselves; teams seeking a managed service or hardened interface should look elsewhere.

Platforms

Caldera is listed for API, Linux, macOS, self-hosted and web use. Its on-premises deployment model and Linux or macOS host requirements make it a better fit for teams with infrastructure to run it than for users seeking a hosted, turnkey tool.

Who it's for

Caldera suits security teams conducting autonomous emulation, manual red-team work, detection and response platform testing, or red-versus-blue research. ATT&CK-based profiles and custom scenarios are useful when teams want repeatable exercises and a way to train blue teams. OT plugins make it relevant to organizations assessing industrial protocols, while the operational and security caveats make it a poor choice for teams without capacity to isolate and maintain the deployment.

Pros and cons

• Pro: Free, open-source access to an extensible ATT&CK-based framework keeps cost from being a barrier to tailored emulation work.
• Pro: Plugins span Atomic tests, OT, incident response, reporting and training, supporting varied assessment and research needs.
• Pro: LDAP and configurable login handling give teams authentication options beyond internal user mapping.
• Con: The web interface has basic security features and is not thoroughly penetration-tested, so deployment needs a secure environment or network.
• Con: Recommended host resources and Python requirements add setup and operating work.
• Con: The Builder plugin does not work in Docker, and container data is ephemeral by default, limiting container workflows unless teams account for those constraints.

Alternatives

Breach and Attack Simulation Software is a useful category starting point for comparing tools in this area.

Atomic Red Team is a better fit when the priority is a free, community-developed test collection designed to run in five minutes or less with minimal setup, rather than Caldera's broader emulation framework.

Infection Monkey is another free, open-source breach-and-attack simulation option for teams looking for a tool available on Linux, Windows, web and self-hosted platforms.

OpenAEV may suit teams that want a free-forever on-premise community edition covering core attack simulation and tabletop exercises, with community support, or want to consider its freemium approach.

Keysight Eggplant Test is an enterprise software option with a free trial and quote-based pricing.

Pentera Platform is a paid alternative for teams seeking commercial details through a personalized demo.

Picus Security Platform offers a 14-day free trial limited to one simulation agent, a ransomware-only threat library and vendor-specific recommendations for one technology.

SCYTHE is worth considering when a team wants a custom-quoted Foundation plan with unlimited seats and agents, a full ATT&CK module library and full integration support.

BlackNoise BAS is another paid option for self-hosted and web use.

Verdict

Choose MITRE Caldera if your security team wants a free, extensible ATT&CK-based framework for tailored adversary emulation, including OT work, and can manage an on-premises deployment. Its broad plugin ecosystem is the main reason to choose it; its basic web-interface security and operational requirements are the main reasons to look elsewhere.