Start with the objective
A penetration test, an attack simulation and a cyber range are not interchangeable services. Separate three questions: do you need to investigate a weakness, observe a control responding to a scenario, or provide an environment for practice and testing?
Penetration testing: what is exploitable within scope?
A penetration test examines specific systems within defined boundaries. A business application assessment might ask whether one user can access another tenant’s data. The value is a traceable investigation of the question, not simply a list of technical signals. The result must show which roles, features and systems were covered.
BAS: how do agreed controls respond?
Breach and Attack Simulation examines defined attack steps and control responses. A scenario might ask whether an agreed test activity is blocked or detected. SafeBreach describes this through scenario execution and analysis of result and event data. This is a vendor description, not evidence that every BAS service provides identical coverage.
Adversary emulation: attacker behaviour
Adversary emulation reproduces selected attacker behaviours. MITRE describes this in its Caldera work through ATT&CK-oriented behaviour emulation. An engagement still needs a concrete scenario scope. Naming a technique in a plan does not establish that it has been fully tested.
Cyber range: the environment
NIST describes a cyber range as a bounded environment for practical scenarios, training and exercises. The term first identifies a place to test. It does not by itself establish what application was assessed or whether a production control would detect an attack. Successful execution in a laboratory is not that evidence.
What to agree before commissioning
Our recommendation is to express the objective as a testable question. Identify the environment, prerequisites and evidence needed to answer it. Detection testing needs appropriate event data; authorization testing needs suitable test identities. Ask which method can support the intended conclusion and what will remain untested.
A decision example
A new customer application with multiple tenants needs targeted assessment of its authorization relationships. Asking whether monitoring can detect a particular attack sequence adds a separate scenario with usable telemetry. Practising the sequence with staff may need a training environment. These engagements can complement each other without being automatically included in one package.
Related assessment
Related reading
Primary sources checked on 26.09.2026.
Sources and limitations are identified in the article.