Best Enterprise Breach and Attack Simulation (BAS) Software

How Many Breach and Attack Simulation (BAS) Software Products Does G2 Track?

Total Products under this Category: 57

Category Stats (Oct 2026)

  • Average Rating: 4.56/5 The average rating of products in this category, based on all submitted ratings
  • Top Trending Product: Pentera (+0.4%) - Among all products in this category, Pentera recorded the largest rating increase compared to last month

Last updated: October 16, 2026

How Does G2 Rank Breach and Attack Simulation (BAS) Software Products?

Why You Can Trust G2's Software Rankings:

  • 30 Analysts and Data Experts
  • 1,300+ Authentic Reviews
  • 57+ Products
  • Unbiased Rankings

G2's software rankings are built on verified user reviews, rigorous moderation, and a consistent research methodology maintained by a team of analysts and data experts. Each product is measured using the same transparent criteria, with no paid placement or vendor influence. While reviews reflect real user experiences, which can be subjective, they offer valuable insight into how software performs in the hands of professionals. Together, these inputs power the G2 Score, a standardized way to compare tools within every category.

G2 Grid® for Breach and Attack Simulation (BAS) Software

G2 Grid® for Breach and Attack Simulation (BAS) Software plotting products by satisfaction and market presence

Highlighted products: Picus Security, Cymulate, Pentera, HTB CTF & Threat Range, Adaptive Security, and Right-Hand Cybersecurity.

Underlying data: [Grid® JSON](https://www.g2.com/categories/breach-and-attack-simulation-bas/grids.json?focus%5B%5D=picus-security&focus%5B%5D=cymulate&focus%5B%5D=pentera&focus%5B%5D=htb-ctf-threat-range&focus%5B%5D=adaptive-security&focus%5B%5D=right-hand-cybersecurity&segment=enterprise)

Picus Security

Picus Security helps organizations continuously validate which exposures attackers can exploit, how far they can reach, and whether security controls can prevent or detect their attacks. The Picus Platform brings together Exposure Validation, Autonomous Penetration Testing, and Breach and Attack Simulation (BAS) in one coordinated program. Each validation method answers a different security question while sharing evidence across assets, exposures, identities, controls, and threats. Exposure Validation determines whether exposures are exploitable across affected assets, helping security teams prioritize remediation based on validated exploitability rather than vulnerability severity alone. Autonomous Penetration Testing chains real exploits from initial access through privilege escalation and lateral movement to uncover exploitable vulnerabilities and validate attack paths to critical assets. Breach and Attack Simulation safely runs real attacker techniques against live security controls to show whether attacks are prevented, detected, or missed. Instead of creating separate findings and priorities for each testing method, Picus uses a shared findings model that is deduplicated, evidence-backed, and asset-aware. This gives security teams shared context and a prioritized backlog for remediation and revalidation. Numi AI and Picus Swarm add an agentic layer across the platform. Specialist agents support discovery, exploitation, validation, mobilization, and reporting workflows. Organizations can run workflows on demand, under human supervision, or autonomously, with decision gates and audit trails that keep teams in control. Picus helps security teams move from scheduled security testing toward change-driven validation, so emerging vulnerabilities, new attack campaigns, security control changes, and infrastructure changes can trigger the right validation method. Teams can use the resulting evidence to prioritize proven risk, remediate or mitigate findings, and revalidate fixes.

Average Rating: 4.8/5.0

Total Reviews: 229

Who Is the Company Behind Picus Security?

  • Seller: Picus Security
  • Company Website:
  • Year Founded: 2013
  • HQ Location: San Francisco, California
  • Twitter: @PicusSecurity
    2,916 Twitter followers
  • LinkedIn® Page: www.linkedin.com
    317 employees on LinkedIn®

Who Uses This Product?

  • Who Uses This: Cyber Security Specialist, Cyber Security Engineer
  • Top Industries: Information Technology and Services, Computer & Network Security
  • Company Size: 38% Large, 37% Medium

What Do G2 Reviewers Say About Picus Security?

AI-generated summary from verified user reviews

Pros
  • Users commend Picus Security for its realistic attack simulations that enhance defenses and confidence in cybersecurity resilience.
  • Users find Picus Security incredibly easy to use, ensuring rapid identification of security gaps with professional support.
  • Users commend Picus Security for its continuous proactive validation of security controls, enhancing defense and resilience against attacks.
  • Users highlight the actionable insights from Picus Security, enhancing defense optimization and improving overall security posture.
  • Users value the seamless integration with existing tools, enhancing security through tailored recommendations and real-time updates.
Cons
  • Users experience reporting limitations with Picus Security, leading to extra work in finalizing reports and occasional issues.
  • Users experience integration issues, particularly with third-party tools, impacting the initial setup and validation process.
  • Users find the steep learning curve of Picus Security challenging, requiring time and training for effective utilization.
  • Users find the complex setup process of Picus Security to be challenging, requiring extra configuration effort initially.
  • Users find the limited customization in Picus Security's reports and dashboards restrictive for their specific needs.

What Are Recent G2 Reviews of Picus Security?

What Are G2 Users Discussing About Picus Security?

Cymulate

Designed for security teams to continuously validate threats and build exposure-informed defenses, the Cymulate Platform combines advanced attack simulation with an agentic cyber defense engineering control plane to continuously prove, prioritize and adapt security controls for the latest threats. With a daily feed of threat intelligence and a comprehensive attack library, Cymulate is a SaaS offering that applies AI to tailor offensive testing to the environment while integrating with security stack to push updates for immediate prevention and detection. Core use cases include threat validation, control validation & tuning, detection engineering, and vulnerability validation and prioritization.

Average Rating: 4.9/5.0

Total Reviews: 176

Who Is the Company Behind Cymulate?

  • Seller: Cymulate
  • Company Website:
  • Year Founded: 2016
  • HQ Location: Holon, Israel
  • Twitter: @CymulateLtd
    1,079 Twitter followers
  • LinkedIn® Page: www.linkedin.com
    214 employees on LinkedIn®

Who Uses This Product?

  • Who Uses This: Security Analyst, Cyber Security Engineer
  • Top Industries: Financial Services, Banking
  • Company Size: 56% Large, 43% Medium

What Do G2 Reviewers Say About Cymulate?

AI-generated summary from verified user reviews

Pros
  • Users appreciate the intuitive and user-friendly design of Cymulate, enhancing accessibility for organizations of all sizes.
  • Users appreciate Cymulate's effective vulnerability identification, enabling actionable insights and continuous threat assessment with ease.
  • Users value the effective continuous security validation offered by Cymulate, enhancing their overall security posture.
  • Users appreciate the helpful and friendly customer support of Cymulate, enhancing their overall experience and effectiveness.
  • Users value Cymulate's extensive customization options, benefiting from dynamic dashboards and a large threat library.
Cons
  • Users note that dynamic reporting and integration stability need improvement for better execution and overall experience.
  • Users note that integration issues hinder Cymulate's effectiveness and call for enhanced compatibility with existing systems.
  • Users find reporting issues time consuming, with delays and a lack of critical data affecting efficiency.
  • Users find the inefficient alert system challenging, affecting real-time notifications and making assessments cumbersome to manage.

What Are Recent G2 Reviews of Cymulate?

Pentera

Pentera is the category leader for Automated Security Validation, allowing every organization to test with ease the integrity of all cybersecurity layers, unfolding true, current security exposures at any moment, at any scale. Thousands of security professionals and service providers around the world use Pentera to guide remediation and close security gaps before they are exploited. Its customers include Casey's General Stores, Emeria, LuLu International Exchange, IP Telecom PT, BrewDog, City National Bank, Schmitz Cargobull, and MBC Group. Pentera is backed by leading investors such as K1 Investment Management, Insight Partners, Blackstone, Evolution Equity Partners, and AWZ. Visit https://pentera.io for more information.

Average Rating: 4.6/5.0

Total Reviews: 191

Who Is the Company Behind Pentera?

  • Seller: Pentera
  • Company Website:
  • Year Founded: 2015
  • HQ Location: Boston, MA
  • Twitter: @penterasec
    3,291 Twitter followers
  • LinkedIn® Page: www.linkedin.com
    460 employees on LinkedIn®

Who Uses This Product?

  • Top Industries: Government Administration, Computer & Network Security
  • Company Size: 53% Large, 33% Medium

What Do G2 Reviewers Say About Pentera?

AI-generated summary from verified user reviews

Pros
  • Users find Pentera's ease of use exceptional, thanks to its automation, customizable scenarios, and simple interface.
  • Users value the effective vulnerability scanning and remediation capabilities of Pentera, enhancing overall security posture.
  • Users value the automation capabilities of Pentera, enhancing their security testing and validation processes efficiently.
  • Users value the responsive customer support from Pentera, enhancing their experience and facilitating smooth operations.
  • Users value the realistic attack simulations offered by Pentera, enhancing their security posture through continuous validation.
Cons
  • Users find the reporting inadequate, suggesting it requires improvement for better enterprise-level insights.
  • Users express concern about the lack of a robust RBAC system, limiting proper access control and user rights management.
  • Users desire improvement in handling false positives, though overall satisfaction with Pentera remains high.
  • Users note the limited reporting capabilities of Pentera, especially for enterprise-level assessments and lacking Spanish translation.
  • Users are concerned about the missing features in Pentera, including updates on vulnerabilities and insufficient RBAC options.

What Are Recent G2 Reviews of Pentera?

AI can help you find the answers. G2 helps you trust them.

Connect G2 to Claude or ChatGPT for answers grounded in G2's trusted reviews, comparisons, and pricing from real user insights.

How it works

HTB CTF & Threat Range

Hack The Box is the leading cyber readiness platform for the human-AI cyber workforce, helping organizations develop and measure the capabilities of the people and AI agents responsible for modern defense. The Capture The Flag platform delivers threat-informed challenges and real-world simulations that build and validate offensive, defensive and AI-enabled cyber capabilities. Trusted by the Fortune 500, government agencies, managed security service providers (MSSPs) and Frontier Labs, Hack The Box supports more than 800 enterprise customers and a global community of over 4 million cybersecurity professionals. For more information, visit hackthebox.com

Average Rating: 4.7/5.0

Total Reviews: 22

Who Is the Company Behind HTB CTF & Threat Range?

  • Seller: Hack The Box
  • Company Website:
  • Year Founded: 2017
  • HQ Location: Folkestone, GB
  • Twitter: @hackthebox_eu
    246,095 Twitter followers
  • LinkedIn® Page: www.linkedin.com
    2,313 employees on LinkedIn®

Who Uses This Product?

  • Top Industries: Computer & Network Security
  • Company Size: 45% Large, 36% Small

What Are Recent G2 Reviews of HTB CTF & Threat Range?

Adaptive Security

Adaptive is the human security platform for the AI era. AI has fundamentally changed the threat landscape. Deepfakes make social engineering more convincing, AI-powered phishing scales attacks 100x, and the rapid adoption of AI tools introduces new risks to every organization. Adaptive unifies security awareness training, agentic email security, and AI governance to secure every attack surface where work happens. Adaptive’s platform trains employees against emerging threats, stops sophisticated email attacks, and secures rogue AI usage. The Company’s platform can be deployed in the browser, on device, and in email inboxes. More than 1,000 leading organizations trust Adaptive, including major global brands like PayPal, MLB, and Bose. The Company has raised over $140M from leading AI investors including OpenAI and NVIDIA, and most recently closed an $81M funding round led by Bain Capital Ventures.

Average Rating: 4.9/5.0

Total Reviews: 138

Who Is the Company Behind Adaptive Security?

  • Seller: Adaptive Security
  • Company Website:
  • Year Founded: 2024
  • HQ Location: New York, US
  • LinkedIn® Page: www.linkedin.com
    285 employees on LinkedIn®

Who Uses This Product?

  • Who Uses This: IT Manager
  • Top Industries: Computer Software, Financial Services
  • Company Size: 72% Medium, 15% Large

What Do G2 Reviewers Say About Adaptive Security?

AI-generated summary from verified user reviews

Pros
  • Users value the concise and engaging training of Adaptive Security, enhancing employee awareness and participation effectively.
  • Users praise the ease of use of Adaptive Security, enjoying smooth deployment and intuitive integration with existing systems.
  • Users appreciate the excellent customer support from Adaptive Security, noting their responsiveness and helpfulness as key benefits.
  • Users appreciate the easy implementation of Adaptive Security, ensuring a smooth setup and quick integration into daily operations.
  • Users value the dramatic increase in security awareness provided by Adaptive Security, ensuring consistent engagement across teams.
Cons
  • Users feel the limited customization options hinder their ability to edit and manage user information effectively.
  • Users feel group management is underdeveloped, requiring manual training assignments and lacking flexible content customization options.
  • Users find the reporting inadequate, lacking flexibility in data presentation for effective exports and stakeholder reviews.
  • Users find the integration process challenging, especially for those without technical expertise, complicating overall usability.
  • Users find the learning curve steep, making setup challenging for non-technical individuals and first-time admins.

What Are Recent G2 Reviews of Adaptive Security?

Right-Hand Cybersecurity

Right-Hand is a Human Risk Management company supporting organizations across North America and APAC, working with teams across a wide range of industries including finance, education, retail, healthcare, and manufacturing. The platform is built to help security leaders understand, measure, and reduce human-initiated risk in modern, distributed environments where technology alone is no longer enough. Most security programs generate large volumes of alerts and telemetry but struggle to translate that data into meaningful insight about human behavior. Right-Hand addresses this challenge by integrating with core security tools such as email security, EDR, DLP, CASB, and SIEM. These integrations surface high-signal events and contextual risk indicators tied directly to user actions, giving teams visibility into where risky behavior occurs, which patterns lead to incidents, and how human risk changes over time across the organization. Building on this foundation, Right-Hand provides purpose-built AI agents that support security awareness execution at scale. The vishing agent enables realistic voice-based simulations, the email agent supports the creation of phishing templates and scenarios, and the training agent helps generate and adapt learning content based on role, behavior, and exposure. Together, these agents allow teams to move beyond static programs and deliver continuous, relevant awareness without relying on one-size-fits-all content or manual effort. The primary value of Right-Hand is turning visibility into action. Instead of compliance-driven training disconnected from real risk, organizations gain a data-informed program that links behavior, learning, and outcomes. Security teams can reduce repeat incidents, lower operational noise, demonstrate progress over time, and build a stronger, more resilient security culture aligned with how people actually work.

Average Rating: 4.8/5.0

Total Reviews: 79

Who Is the Company Behind Right-Hand Cybersecurity?

  • Seller: Right-Hand Cybersecurity
  • Company Website:
  • Year Founded: 2019
  • HQ Location: Lewes, Delaware
  • Twitter: @righthand_ai
    139 Twitter followers
  • LinkedIn® Page: www.linkedin.com
    44 employees on LinkedIn®

Who Uses This Product?

  • Top Industries: Financial Services, Information Technology and Services
  • Company Size: 57% Medium, 27% Large

What Do G2 Reviewers Say About Right-Hand Cybersecurity?

AI-generated summary from verified user reviews

Pros
  • Users highly value the outstanding customer support from Right-Hand Cybersecurity, enhancing their overall training experience significantly.
  • Users enjoy the user-friendly interface of Right-Hand Cybersecurity, enhanced by dedicated support from their account manager.
  • Users find Charlton to be very helpful, enhancing their experience and exceeding expectations with exceptional support.
  • Users value the comprehensive training support from Right-Hand Cybersecurity, enhancing engagement and ease of customization.
  • Users praise the personalized approach of Right-Hand Cybersecurity, enhancing training with real-time insights and engaging tools.
Cons
  • Users note the limited automations and integrations in Right-Hand Cybersecurity, wishing for more granular control within the platform.
  • Users find the inadequate reporting capabilities of Right-Hand Cybersecurity limits their access to detailed insights and analysis.
  • Users find the Phishing issues in Right-Hand Cybersecurity need better resolution workflows and reporting capabilities.
  • Users face integration issues with limited APIs and missing connections to essential tools like Drata.
  • Users note the limited customization options with Right-Hand Cybersecurity, wishing for more flexibility in roles and reporting.

What Are Recent G2 Reviews of Right-Hand Cybersecurity?

What Are G2 Users Discussing About Right-Hand Cybersecurity?

Brandon Summers-Miller
BS
Researched and written by Brandon Summers-Miller
Updated