AttackIQ Reviews

My main use case for AttackIQ is for security information and event management. I monitor incidents, check and analyze them, and then respond to the incidents. I use AttackIQ for more observations and analysis.

The orchestrations and automations of AttackIQ impact my organization positively. We can integrate all of that for process improvement, which will be the best improvement we can provide to the organization or the company.

AttackIQ has reduced the incident response times and response for the objectives to improve the efficiency of incidents. From investigations and analysis that previously took four to eight hours, I can now complete them in about ten minutes because of the automations and orchestration. Additionally, for the validation of trusted sites and verifications like VirusTotal, the Threat Vault, and ThreatFox, the system will automatically respond to an incident that occurred.

AttackIQ offers quick response and gathers more information so I could identify some compromise or incident compromise and perform some analysis.

I love the feature for detection engineering, security control validations, zero trust, MITRE ATT&CK, third-party risk validation, and defense optimization. AttackIQ Ready! validations, AttackIQ Flex, and the Command Center help my workflow.

For the governance and security of AttackIQ, I believe these surpass the standards of ISO and the NIST standard. Upon review, the optimizations and documentation of AttackIQ are great. The information is complete, and overall, it is awesome.

For the accuracy and reliability of output, AttackIQ provides very great information, especially for every incident or request that has occurred. As I have experienced, it provided a great outcome, trustable results, and verified results.

Overall, it is great and awesome. I am very happy and thankful for AttackIQ for providing this great application with complete platforms ready. The Enterprise, Command Center, operating system, and solution are great, covering detection engineering, compliance optimizations, defense optimizations, and security control validations. The at-scale offensive testing is great as well, along with red team augmentations, adversary emulation, reduced exposure, and vulnerability prioritization.

The optimized defensive posture and especially the zero trust aspect make me very happy regarding AttackIQ, especially its MITRE ATT&CK integrations and third-party risk validations. That is overall awesome.

I have not used the other features of AttackIQ, but the best part is the integration of other applications that are not currently available for AttackIQ. If they can integrate with AI technology, it would be much better.

For the documentation and support, specifically regarding documentation, it should have a knowledge transfer and knowledge-based data center where I can get important insights or experiences that I can manage to fix my incident response. I should be able to automatically access incidents I created, which includes process improvement, additional information, and especially the AI or artificial intelligence integration.

I have been using AttackIQ for five months.

AttackIQ is stable so far. The information and verification are great, and the analysis and observation are awesome.

AttackIQ's scalability is great because it can manage multiple applications and endpoints.

The customer support is great and awesome. They provide what customers need and sometimes exceed expectations. Overall, it has been great and delivered the best results.

I rate customer support an eight. There are two areas needing improvement for anything that might happen.

Before, we used Wazuh, which is a free open-source application. However, AttackIQ has provided more significant and improved capabilities, especially the solutions it offers, which is why we switched to this application.

Regarding employees, AttackIQ has provided great support and improvement for efficiency. It has had a great turnaround for money saved due to the multiple applications and licensing we used before; now we only focus on this application. However, I cannot provide specific metrics right now because we need that information for our report. Overall, it was a great application and delivered the best results for the company.

I tried the demo or the free version before, and the pricing was great. The price is fair and helpful, as the support is also beneficial. The impact has been good.

We evaluated Wazuh, the expensive Splunk, and CrowdStrike, which is also expensive.

I rate AttackIQ an eight for now. I choose eight for the two remaining aspects that should involve process improvement and further improvements for AttackIQ.

If you are looking into using AttackIQ, I advise ensuring that it is trustworthy. You should be concerned about the integrity of applications as well, and AttackIQ provides reputable information. It can offer the needed information and efficiency that you want to apply in your company. It is easy to manage and use, and the GUI or graphical user interface is good, providing very informative and verified information that you can apply to analyze, respond, and create reports for your organization.

This application is great for reporting, with a dashboard that provides a detailed view of all the information in one place. I think that is the best part I experienced with AttackIQ.

The key features that we mainly depend on are the continuous validation of security controls through repeatable attack simulations. Whenever there's a breach or attack simulation happening, the support, testing, preventing, detection, and response behind it is completely ongoing.

At the same time, exposure management, rather than just a one-time security assessment, helps us to stay on top of what's happening in the environment and reduces fatigue for a SOC engineer or someone managing the SOC to find the actual attack entrance, the problem behind it, or how the breach might have taken place.

From a SOC perspective, AttackIQ gives us clear evidence of where the controls are working in real conditions and is practically strong for identifying detection gaps and response weaknesses. Being aligned with MITRE ATT&CKs makes it easier to prioritize and communicate our findings back to our clients running in our SOC.

There are several use cases for how we use AttackIQ in our SOC. It is most useful for validating detection coverage, testing response readiness, and confirming whether endpoint and security controls behave as expected. It is also a strong fit for post-deployment validation after introducing new tooling because it helps prove whether the changes actually improve the security posture. AttackIQ works particularly well with ransomware simulations, exposure management programs, and recurring control assessments. For my team that wants to measure defensive capability over time, it provides a structured and repeatable way to do that.

Running in our SOC, it moves the conversation from assumptions and dashboards to measurable proof, which is exactly what makes AttackIQ valuable in day-to-day security operations.

The breach and attack simulation that supports testing, prevention, detection, and response is a key feature for me, as is the ongoing exposure management, rather than a one-time security assessment. AttackIQ's reporting helps translate technical findings into actionable remediation steps, which are easy to understand. The continuous validation of security controls through repeatable attack simulations is a massive advantage for me.

Once properly implemented, AttackIQ becomes a valuable part of a continuous validation program.

The one feature I rely on the most from AttackIQ is specifically the continuous validation of security controls through repeatable attack simulations. From the reporting that stands out, once you have the report, the translation from a technical finding perspective and how they align with actionable remediation steps is easy to understand, which helps significantly.

From a SOC perspective, AttackIQ running in our SOC is a solid enterprise-grade platform delivering genuine operational value. The biggest strength for me is the realism, its alignment with all the compliance situations we might have, and the ability to continuously validate control effectiveness. By doing that, we can continuously provide feedback to our customers to ensure they are running the best of breed for their security posture and environment. AttackIQ is best viewed as a tool that helps a SOC move from assumption-based security to evidence-based security, while providing reporting that can easily be communicated in layman's terms to your customer base. It is most effective for teams that want to prove their controls work, identify gaps early, and continuously improve rather than just rely on periodic testing alone.

There is a learning curve at the beginning, especially for teams that are quite new to a BAS or continuous validation solution. Setup and integration can take time before the platform really delivers full value. AttackIQ works best when a SOC already has a process for acting on findings. One challenge we have had is teams expecting instant results without workflow maturity, which may not yield the full benefit right away. It takes some time to really get the solution or the outcome that you want.

I have been using AttackIQ in our SOC environment for the past four years.

AttackIQ is stable.

AttackIQ is quite scalable as long as you understand what you want to do with it and where you want to go. The important thing is to understand your need and the bigger picture, and then the scalability will come into play.

AttackIQ's customer support is brilliant.

I have not needed customer support too many times, but from the times we have had instances where we needed customer support, I would rate it an eight out of 10.

Previously, we did use a different solution. However, I am not going to say which solution it was, but we switched because of the difficulty in integrations, as the reporting was quite disorganized, difficult to understand, and difficult to really articulate back into layman's terms. The cost was excessive.

The rollout process is quite easy to do because we have a mature SOC team and engineers around it. The understanding process on how to get all of this to tie back into an existing mature SOC took some challenges, but it was easily resolved.

We have seen a massive return on investment with AttackIQ, specifically from a resource perspective and time spent on findings due to the fact that the accuracy of the reporting or the accuracy of the findings from AttackIQ was brilliant. This saves a lot of manpower time.

The accuracy of AttackIQ is very good and the reliable output is straightforward and easy to understand.

The advice I would give to others looking into using AttackIQ is to make sure that your SOC already has a process for acting on findings and that the SOC is mature enough to handle AttackIQ. I rate this review a 9 out of 10.

I use AttackIQ primarily as part of security validation and threat exposure assessment within our cybersecurity operation, where the platform is mainly used to simulate attack techniques and validate whether the existing security controls are effectively detecting and responding to the threats.

We conducted a purple team exercise where we used AttackIQ to simulate attack behaviors mapped to MITRE ATT&CK techniques with the control testing environment, with the main goal being to validate whether the SIEM detection was triggering correctly and to check if the endpoint security controls are responding as expected, and if the SOC monitoring workflows were functioning properly. That exercise helped identify a few detection gaps where certain behaviors were either not generating alerts consistently or lacked sufficient contextual visibility, and based on the findings, the security team refined the SIEM correlation rules, improved the alert prioritization, and enhanced monitoring coverage for specific attack techniques.

Some of the best features I found in AttackIQ are its continuous security validation capabilities, MITRE ATT&CK alignment, and the ability to proactively test whether security controls are actually working as expected in real-world attack scenarios, representing real-world case studies and best features I have encountered in my project.

The continuous security validation capabilities of AttackIQ were one of the most valuable parts used by our team, especially since before using the platform, a lot of validation activities depended on periodic penetration testing, manual testing, or assumptions that security controls are functioning, which presented an actual challenge for the overall organization. AttackIQ helped change that, making validation more operational, repeatable, and proactive. From a usability perspective, once the initial setup and workflows are configured, the platform becomes fairly straightforward for day-to-day validation activities, with MITRE ATT&CK mapping and predefined attack scenarios making it easier for security teams to understand what was being tested and how the controls were responding.

AttackIQ has had a positive impact on the organization, especially in the areas of continuous security validation, detection improvement, and overall defensive readiness, with highlights including improved visibility into detection gaps, stronger security controls validation, better SOC readiness, and faster detection engineering improvements, which are improvement areas we have implemented in our project using AttackIQ.

The overall detection has actually improved with AttackIQ, as the SOC improved, which reduced a lot of false positives and increased the detection rate and accuracy. Previously, a lot of time was consumed to detect something or to conduct false positive investigations, but after implementing AttackIQ, there is now a reduction of almost 40 to 50% in the overall time and effort, making it an impactful area.

One area for improvement is the initial configuration complexity, which is very complex in the initial stage to configure the whole thing and integrate with the SOC, presenting a learning curve for organizations that are new to adversary emulation or continuous security validation, particularly concerning the initial setup scenario customization and workflow tuning.

Another area is reporting and dashboard customization. While the platform provides useful technical visibility, more flexibility for executive-level reporting, customizable dashboards, and compliance-oriented summaries can enhance communication across different stakeholders.

The only improvement I would suggest apart from the areas mentioned is the onboarding process, which is very complex and takes a lot of time to understand the workflows. It can be simplified for easier implementation.

I have been using AttackIQ for one year.

AttackIQ is quite stable.

In my experience, AttackIQ scales well for enterprise-level security validation and continuous testing use cases, particularly in environments with distributed infrastructure, multiple security controls, and evolving detection strategies.

Overall, my experience with the customer support of AttackIQ has been positive, with the support team generally responsive, technically knowledgeable, and helpful during both onboarding and operational phases.

AttackIQ is the first solution I have used.

One area for improvement is the initial configuration complexity, which is very complex in the initial stage to configure the whole thing and integrate with the SOC, presenting a learning curve for organizations that are new to adversary emulation or continuous security validation.

From my perspective as a vendor providing security consulting services, I find that AttackIQ is very useful for saving time and effort, especially since it helps integrate with SIEM solutions and provides many detections that might not be accurate in your SIEM, effectively reducing the need for additional engineers on the SIEM side, and it can also help reduce false positive detection.

If you are providing the security solutions or security operations center solutions to a customer, or if you are implementing that solution in your company and want to focus on threat detection, false positive detection, and reducing effort and time, then you can implement AttackIQ workflows, integrating with SIEM solutions and onboarding all workflows to easily obtain detections and enhance SIEM engineering rules for better proactive results; that will certainly benefit the security operations center.

AttackIQ was recommended by our customers, who were very confident about the tool, prompting us to learn about the techniques before implementing it.

One additional point I would like to add is that we will improve continuous security validation. Traditionally, many organizations rely heavily on periodic penetration tests or isolated assessments to evaluate security effectiveness, while AttackIQ helped us achieve a more continuous and operational approach to security controls, detections, and monitoring workflows, actually working as intended over time. We are the customer. I would rate this product a 7 out of 10.

My main use case for AttackIQ is security control and validation, breach and attack simulations, detection validation, and security posture assessment.

I used AttackIQ to simulate MITRE ATT&CK techniques such as phishing related credential access and lateral movement to verify whether Microsoft Defender for Endpoint and our SIEM generated the expected alerts. I reviewed any detection gaps, fine-tuned detection rules, and reran the assessment to confirm the improvements.

My primary focus was validating the effectiveness of our existing security controls rather than just checking compliance. AttackIQ helped me to identify detection gaps, verify the security tools were working as expected after policy changes, and improve my responses by safely simulating real-world attack tactics.

The best features AttackIQ offers include MITRE ATT&CK mapping, automated breach simulations, security control validations, detection gap analysis, and detailed reporting.

AttackIQ has improved my security posture by validating security controls, identifying detection gaps, and increasing confidence in my detection and response capabilities.

The feature I rely on most is security control validation. It gives me confidence that my security controls and detection mechanisms are working as expected against real-world attack techniques. Instead of assuming my defenses are effective, I can validate them regularly, identify gaps, and fine-tune my security tools before an actual incident occurs. I was impressed by the MITRE ATT&CK-based simulations and the depth of the reporting.

I would appreciate even deeper integrations with security tools and more automated remediation recommendations to streamline follow-up actions.

I would appreciate deeper integrations with security tools. AI-assisted remediations and recommendations would be helpful. Easier customization of attack scenarios and more actionable reporting that prioritizes findings based on risk would also be beneficial. One improvement that would make my workflow smoother is more automation around remediation. After a simulation identifies a detection gap, it would be helpful if AttackIQ could recommend specific configuration changes or detection rules based on the security tools in use.

The AI governance appears good, but I would appreciate greater transparency regarding how AI recommendations are generated, stronger administrative controls, and clear data privacy and compliance options for enterprise environments. The AI output is accurate and reliable enough to assist security teams, but it still benefits from human review. Improving contextual awareness and making recommendations more environment-specific would increase confidence in the results.

I have been using AttackIQ for more than three years.

Rating: 4

I suggest defining clear use cases, integrating AttackIQ with your security tools, and running simulations regularly. AttackIQ is a strong platform for security validations. Better integration, AI-driven remediations, and customizable reporting would make it even better. I would rate this product an 8 out of 10.

We use AttackIQ for automated, continuous testing and offensive testing. We use their scaled offensive testing module in AttackIQ, which continuously validates your environment and cloud environment, then identifies exposures that we take and try to fix them.

I'm the security person on the team, so AttackIQ has become really useful for us to automate this continuous testing because before we would only have point-in-time testing. We would only be able to get a scan at a single point in time, but now it's useful because it provides continuous monitoring.

We use public cloud for AttackIQ.

The continuous testing and continuous offensive testing are among the best features that AttackIQ offers, and being able to categorize it based on criticality such as very critical, emergency, high, medium, and low is valuable.

AttackIQ allows us to resolve issues much quicker because these issues come in categories, enabling us to prioritize them and fix the emergency issues first.

It has definitely reduced response time and improved our discoverability of these issues in the first place.

I can't think of anything right now about how AttackIQ can be improved because I probably need to use it for a little bit more before I can understand what needs to be improved. So far I don't have anything that I could identify.

I have been using AttackIQ for four and a half months.

AttackIQ is stable.

AttackIQ's scalability has been good and we have had no issues with it so far.

The customer support for AttackIQ is pretty quick and we have no issues.

This is our first time using a solution like AttackIQ.

My experience with the pricing, setup cost, and licensing for AttackIQ was pretty easy. We didn't have any issues and it was pretty straightforward.

It's hard to say about money saved because it has only been four and a half months with AttackIQ, but definitely a lot of time has been saved. I would say approximately 15% of our time.

We evaluated Pentera as well before choosing AttackIQ.

I would rate AttackIQ a 10 out of 10 because so far I have no issues with it. AttackIQ is solving a lot of the problems that I had before or that we as an organization had before, even the security team, so it's solving all my issues. I would say definitely make sure you know your use case before you purchase AttackIQ. I give this product a rating of 10 out of 10.

My main use case for AttackIQ is conducting breach and attack simulation or any kind of new ransomware simulation, basically for executing particular real-world attack scenarios.

Regarding my main use case, I have used AttackIQ Ready, Flex, and Enterprise, which are the main three product types I have utilized most.

The best features AttackIQ offers include being a cybersecurity platform specializing in breach attack simulation and AEF validation, as it tests the organization's defenses by simulating real-world attack behavior, which are aligned with the MITRE ATT&CK framework, providing a platform where I can run real-world attack scenarios and identify and mitigate them.

AttackIQ is well-aligned with the MITRE ATT&CK framework and has strong continuous validation. The platform is built to run continuous and automation tests, which helps during point-in-time checks or reduces blind spots.

AttackIQ positively impacts my organization as most of my colleagues and seniors have been using it to understand real-world attack scenarios and how to cope with those situations, benefiting the company, colleagues, and team.

After using AttackIQ, it has helped the team and the company improve on false positives and reduce risk, as most people are now capable of identifying how to work on detection, improving fine-tuning and all those things. It has definitely benefited the organization in terms of faster risk identification and faster response times.

AttackIQ can be improved by implementing more of a security training platform focused on real-world scenarios, simulating real-world attack behavior aligned with the MITRE ATT&CK and NIST frameworks, which would help further on this prospect.

It can also improve in terms of identifying control gaps.

I have been using AttackIQ for almost close to two years.

In my experience, AttackIQ is stable with no issues regarding downtime or reliability.

The scalability of AttackIQ is good and on the brighter side, as it can handle increasing workloads and more complex simulations as my needs grow without any problem.

The customer support for AttackIQ is quite quick to resolve issues, and my experience with their support team was positive.

Positive

I have not used any previous vendor other than AttackIQ, as I focused on simulation rather than in-hand company usage.

My experience with pricing, setup cost, and licensing for AttackIQ is that since I was using the free version, I did not purchase it initially and was only utilizing the platform, doing lab simulations that were free in that environment.

The value of AttackIQ is good; while it is not extremely high, it is on the good side where you can save money on AttackIQ, irrespective of the product you are going for.

Before choosing AttackIQ, I evaluated other platforms like ARCx, Codecademy, and AWS Skill Builder.

In my current organization, we are not using AttackIQ; in my previous organization, I have used AttackIQ, and it was more of hands-on training rather than being deployed as a typical tool for improvement or knowledge enhancement.

In my previous experience with AttackIQ, it was all on-premises and training; we have not used any private cloud vendor.

My advice for others considering using AttackIQ is that people can utilize it since it offers free training on purple teaming and pre-simulation, which are useful for professional growth and skills development, even for those with limited industry certifications. I would rate this review an eight out of ten.

I primarily use the solution for my own personal projects. It's a BAS - Breach and Attack Simulation.

Overall, I've had a good experience with the product. It's worked well for me.

I can't think of any features that are lacking just now. It does everything I need it to do.

I don't have too much experience with the solution. I need more time to really study the solution to see if there are any shortcomings.

The initial setup was quite difficult and took a long time.

I've been using the solution for two months at this point. It hasn't been that long just yet.

I can't really speak to the stability of the product. I haven't had any issues, however, I haven't used it for too long either.

I haven't had any issues with the product just yet. Therefore, I haven't reached out to technical support before. Having not spoken to them, it's hard for me to gauge their level of knowledge or responsiveness. I wouldn't be able to really comment.

The initial setup was difficult. It was not straightforward. I struggled at the outset to get everything up and running.

The deployment itself took a long time to execute on.

The product does require regular maintenance as well.

I'm just a customer and I personally use the product. I don't have a business relationship with the company.

I use both cloud and on-premises deployments.

Overall, I would rate the solution seven out of ten. I haven't worked with it that long, and I only really use it personally. I would need to take some time to really judge its effectiveness and to see if there is anything in terms of features that are lacking.

Basically, I use AttackIQ for exposure management where I have customers who want attack surface validation on their risk profile and cyber exposures. I have used it in a couple of places where the customer entities were scanned all the time. They wanted it to be scanned to make sure that there are no misconfigurations.

A specific example of how I used AttackIQ for exposure management is with a customer who has many services hosted on top of AWS instances. These are a mix of PaaS and SaaS platforms. Because the development team is separate and the infrastructure management team is separate, the developers wanted visibility on what things are exposed from the development side as well as from the production side, and they wanted to validate that. There was a use case from the infrastructure side regarding whether there are any misconfigurations or open ports. They did not want to be exposed to scanning continuously and wanted it to be reported. AttackIQ helped and worked closely with the CSO to come up with a plan.

The main use case is for exposure management, but I understand that there are other verticals as far as AttackIQ is concerned, but that is the one that I have used it for.

I would say that the features of AttackIQ I find most valuable are its ease of use and the integration with security tools. It adds a lot of value for the customer when it can be integrated with their ecosystem to be tracked, so with the customer having multiple security tools in place, the integration helps a lot.

The integration with security tools helped my customers because the platform itself does the scanning, and as continuous scanning occurs, any deviation from the standard happens. We can either pull the logs or pull the alerts via API, or it can be exported depending on what kind of SOC tool that you use. That particular alerting mechanism is critical when it comes down to making sure that the operations are working as expected. I appreciate that feature.

AttackIQ has positively impacted my organization and my customers by making it easier for them to validate their configurations all the time when it is not easy to do so. Anyone can make a small mistake. Exposure management, as it does continuous scanning all the time, reduces the time of detection of any configuration errors or something unwanted exposed over time. It helps a lot because what I have seen is that most of the time, misconfigurations lead to catastrophes. AttackIQ helps with that.

I wish AttackIQ could improve in that I would rather have more freedom in the way the policies are configured as far as the scans are configured. That is one thing. I also would appreciate more context over any vulnerabilities found or an evidence-based approach similar to a proper vulnerability management platform that would give a screenshot or a log or something that proves that this is there. More verbosity on that end would help.

I have used AttackIQ in a couple of projects where we have SOC integration for AttackIQ.

AttackIQ has been stable in my experience, with no issues of uptime or reliability.

The scalability of AttackIQ has been good; it handled growth or increased usage pretty well for this particular customer.

The customer support for AttackIQ is good but can be better.

I have tested other solutions as well, and AttackIQ is the platform I used. I chose to switch to AttackIQ because of the integration that they provide.

I have definitely seen a return on investment from AttackIQ. Time saved is evident. I may have to connect back to the customer to figure out whether it has reduced the number of incidents, but time saved for configuration mistakes and those kinds of things is definitely positive.

Before choosing AttackIQ, I evaluated other options such as CloudSec.

My advice for others looking into using AttackIQ is that it is a good product. Configure the scans the way you want them, but make sure that you are not too aggressive with the scanning. I would rate this product a nine out of ten.