From assumption to evidence

Validation & Frameworks

Test whether security controls work as intended, then use a shared framework to describe coverage, gaps, and improvement priorities.

Find my path Start the foundations

Evidencecontrols tested safely

2learning routes 2practical tools 1clear first step

01

Validate with evidence

Select each stage to see how a safe test becomes a measurable security improvement.

01DefineChoose a control and outcome 02EmulateRun bounded behaviour 03ObservePreserve control evidence 04AssessCompare expected and actual 05ImproveFix and test again

Stage 1 Define the question and boundary

Select one security control, a representative behaviour, the authorised systems, and the evidence that will demonstrate success or failure.

Ask: What exactly are we testing, and what result should the control produce?

02

Find your learning path

Choose your goal. The page will highlight the most useful place to begin.

I am new to validation I want to test a control I want to map behaviour

Best match Learn the foundations

Understand validation, BAS, adversary emulation, scope, safety, and evidence before running a test.

Recommended firstLearn security validation Understand how controlled tests provide evidence about preventive, detective, and response controls. Level Beginner Setup None Time 45 to 60 min Outcome Explain the difference between validation, BAS, and adversary emulation. Open guide

Practical validation pathEmulate adversary behaviour Use MITRE Caldera to run a bounded operation and compare expected security-control behaviour with observed evidence. Learning Guided beginner Try 20 to 30 min Full lab 3 to 5 hours Outcome Run and document one authorised, ATT&CK-aligned validation. Open guide

Shared language pathMap behaviour and coverage Use threat frameworks to describe techniques consistently without treating a mapping as proof of protection. Level Beginner Setup None Time 45 to 90 min Outcome Build and explain a focused ATT&CK technique map. Open guide

03

Build your foundation

Learn what to test and how to describe it before choosing an automation platform.

1

Measure control behaviourUnderstanding Security Validation

Define safe tests, expected outcomes, evidence, and retest criteria.

2

Describe adversary behaviourUnderstanding Threat Frameworks

Use ATT&CK as a common language for techniques, coverage, and gaps.

04

Choose a tool by outcome

Choose MITRE Caldera to execute a controlled test or ATT&CK Navigator to communicate a focused mapping.

Test control behaviourAutomated adversary emulation Map techniquesCoverage and communication

Best starting point for controlled adversary emulation MITRE Caldera

Plan and execute authorised ATT&CK-aligned behaviours, then compare the resulting telemetry and control response with your expected outcome.

Also consider ATT&CK Navigator when the immediate goal is mapping or communicating technique coverage.

Explore MITRE Caldera

05

Check your validation readiness

Complete these checks before executing adversary behaviour, even in a lab.

!

Preparation requiredComplete all five safety checks before starting.

I own the systems or have explicit permission to test them. The target, technique, time window, and stop conditions are documented. The environment is isolated and recoverable. I recorded the expected preventive, detective, and response evidence. An authorised owner can stop the test and restore affected systems.