# Best Breach and Attack Simulation (BAS) Software for Small Business ## How Many Breach and Attack Simulation (BAS) Software Products Does G2 Track? **Total Products under this Category:** 54 ### Category Stats (Aug 2026) - **Average Rating:** 4.56/5 (↑0.01 vs Jul 2026) The average rating of products in this category, based on all submitted ratings - **Top Trending Product:** OpenAEV by Filigran (+5.56%) - Among all products in this category, OpenAEV by Filigran recorded the largest rating increase compared to last month _Last updated: August 15, 2026_ ## How Does G2 Rank Breach and Attack Simulation (BAS) Software Products? **Why You Can Trust G2's Software Rankings:** - 30 Analysts and Data Experts - 1,200+ Authentic Reviews - 54+ Products - Unbiased Rankings G2's software rankings are built on verified user reviews, rigorous moderation, and a consistent research methodology maintained by a team of analysts and data experts. Each product is measured using the same transparent criteria, with no paid placement or vendor influence. While reviews reflect real user experiences, which can be subjective, they offer valuable insight into how software performs in the hands of professionals. Together, these inputs power the G2 Score, a standardized way to compare tools within every category. ## G2 Grid® for Breach and Attack Simulation (BAS) Software ![G2 Grid® for Breach and Attack Simulation (BAS) Software plotting products by satisfaction and market presence](https://www.g2.com/categories/breach-and-attack-simulation-bas/grids.png?focus%5B%5D=56073&focus%5B%5D=168853&focus%5B%5D=1312654&focus%5B%5D=1561954&focus%5B%5D=127372) Highlighted products: Picus Security, vPenTest, AI-Native Continuous Offensive Security Platform, Simulations Labs, and Defendify All-In-One Cybersecurity Solution. Underlying data: [Grid® JSON](https://www.g2.com/categories/breach-and-attack-simulation-bas/grids.json?focus%5B%5D=picus-security&focus%5B%5D=vpentest&focus%5B%5D=ai-native-continuous-offensive-security-platform&focus%5B%5D=simulations-labs&focus%5B%5D=defendify-all-in-one-cybersecurity-solution&segment=small-business) **Sponsored** ### Picus Security Picus Security helps enterprise security teams reduce cyber risk with the Picus Autonomous Exposure Validation Platform. Picus proves what attackers can actually exploit in your environment and what your security controls stop, turning every exposure into a defensible decision: patch, mitigate, monitor, or accept. The platform validates attack surfaces, exposures, and security controls as one continuous loop, uniting breach and attack simulation, automated penetration testing, and exposure validation. With techniques mapped to MITRE ATT&CK, teams prioritize by real exploitation risk instead of severity scores, prove their EDR, SIEM, and firewall controls work, and report measurable risk reduction to leadership. Picus pioneered Breach and Attack Simulation in 2013 and works with security teams across financial services, healthcare, energy, and technology. [Visit website](https://www.g2.com/external_clickthroughs/record?secure%5Bad_program%5D=ppc&secure%5Bad_slot%5D=category_product_list_llm&secure%5Bcategory_id%5D=2047&secure%5Bchosen_at%5D=2026-08-15T06%3A14%3A13Z&secure%5Bdisplayable_resource_id%5D=2047&secure%5Bdisplayable_resource_type%5D=Category&secure%5Bmedium%5D=sponsored&secure%5Bplacement_reason%5D=page_category&secure%5Bplacement_resource_ids%5D%5B%5D=2047&secure%5Bprioritized%5D=false&secure%5Bproduct_id%5D=56073&secure%5Bresource_id%5D=2047&secure%5Bresource_type%5D=Category&secure%5Bsource_type%5D=category_page&secure%5Bsource_url%5D=https%3A%2F%2Fwww.g2.com%2Fcategories%2Fbreach-and-attack-simulation-bas%2Fsmall-business&secure%5Btoken%5D=951a68aaf546754b5b024191cb80b718ce27f5abe919e8eed0cee36e7ae42151&secure%5Burl%5D=https%3A%2F%2Fwww.picussecurity.com%2Fschedule-demo%3Futm_source%3Dg2%26utm_medium%3Dpaidsocial%26utm_campaign%3Dpicus_profile_promo&secure%5Burl_type%5D=book_demo) ### [Picus Security](https://www.g2.com/products/picus-security/reviews) Picus Security helps enterprise security teams reduce cyber risk with the Picus Autonomous Exposure Validation Platform. Picus proves what attackers can actually exploit in your environment and what your security controls stop, turning every exposure into a defensible decision: patch, mitigate, monitor, or accept. The platform validates attack surfaces, exposures, and security controls as one continuous loop, uniting breach and attack simulation, automated penetration testing, and exposure validation. With techniques mapped to MITRE ATT&CK, teams prioritize by real exploitation risk instead of severity scores, prove their EDR, SIEM, and firewall controls work, and report measurable risk reduction to leadership. Picus pioneered Breach and Attack Simulation in 2013 and works with security teams across financial services, healthcare, energy, and technology. **Average Rating:** 4.8/5.0 **Total Reviews:** 229 #### Who Is the Company Behind Picus Security? - **Seller:** [Picus Security](https://www.g2.com/sellers/picus-security) - **Company Website:** www.picussecurity.com - **Year Founded:** 2013 - **HQ Location:** San Francisco, California - **Twitter:** @PicusSecurity 2,916 Twitter followers - **LinkedIn® Page:** [www.linkedin.com](https://www.g2.com/external_clickthroughs/record?secure%5Bsource_type%5D=product_profile&secure%5Btoken%5D=1071751e714fd0ce1530e5a7b8ca294f43039133144caf44668408ee0d546e8f&secure%5Burl%5D=https%3A%2F%2Fwww.linkedin.com%2Fcompany%2Fpicus-security%2F&secure%5Burl_type%5D=linkedin_company_website) 315 employees on LinkedIn® #### Who Uses This Product? - **Who Uses This:** Cyber Security Specialist, Cyber Security Engineer - **Top Industries:** Information Technology and Services, Computer & Network Security - **Company Size:** 38% Large, 37% Medium #### What Do G2 Reviewers Say About Picus Security? _AI-generated summary from verified user reviews_ ##### Pros - Users value Picus Security for its **realistic and proactive attack simulations** , enhancing defenses and fostering confidence in cybersecurity. - Users commend the **ease of use** of Picus Security, highlighting its reliable performance and responsive support team. - Users commend **continuous validation** in Picus Security, enhancing security posture and identifying gaps through real-world simulations. - Users value the **actionable insights** from Picus Security, optimizing defenses through real-world attack simulations and clear reporting. - Users praise the **seamless integration** of Picus Security with existing tools, enhancing overall cybersecurity effectiveness. ##### Cons - Users face **reporting limitations** with Picus Security, requiring additional effort to finalize reports and access data. - Users face **integration issues** with limited third-party coverage, hindering seamless validation and complicating initial setup. - Users face a **steep learning curve** with Picus Security, requiring time and training to fully utilize its features. - Users find the **complex setup** of Picus Security requires considerable effort, especially for advanced configurations. - Users find the **limited customization** options for reports and dashboards restrict their ability to tailor security assessments. #### What Are Recent G2 Reviews of Picus Security? **["A Proactive Approach to Threat Readiness"](https://www.g2.com/survey_responses/picus-security-review-11441729)** **Rating:** 4.5/5.0 stars _— Rohit Y._ [Read full review](https://www.g2.com/survey_responses/picus-security-review-11441729) **["Picus Makes Our Security Stronger"](https://www.g2.com/survey_responses/picus-security-review-11497382)** **Rating:** 5.0/5.0 stars _— Ved Prakash M._ [Read full review](https://www.g2.com/survey_responses/picus-security-review-11497382) #### What Are G2 Users Discussing About Picus Security? - [What is Picus Security used for?](https://www.g2.com/discussions/what-is-picus-security-used-for) ### [vPenTest](https://www.g2.com/products/vpentest/reviews) Vonahi Security is building the future of offensive cybersecurity by delivering automated, high-quality penetration testing through its SaaS platform, vPenTest. Designed to replicate the tools, techniques, and methodologies of experienced consultants, vPenTest brings the benefits of manual network penetration testing into an easy-to-use, automated solution. Traditionally, penetration testing has been a manual, time consuming, and expensive process that many organizations only perform once or twice a year. This often leaves businesses exposed to emerging threats between assessments. vPenTest addresses this gap by offering fast, consistent, and on-demand testing that helps organizations evaluate their real-time cybersecurity risk more effectively. Powered by a proprietary framework that evolves through continuous research and real-world insights, vPenTest stays aligned with the latest attack techniques and industry best practices. The platform is backed by over 13 years of offensive security expertise, with the team holding certifications such as CISSP, OSCP, OSCE, CEH, and more. Their knowledge is built directly into the platform, ensuring each test is conducted with depth, consistency, and accuracy—without the delays or variability of manual testing.
 vPenTest enables organizations to run internal and external network penetration tests as often as needed monthly, quarterly, or prior to audits or insurance reviews. The automated reports provide actionable insights that make it easy to prioritize remediation and demonstrate progress toward compliance. Today, over 22,000 organizations rely on vPenTest to strengthen their security posture and reduce risk. This includes managed service providers, managed security service providers, financial institutions, compliance-driven organizations, and internal IT teams. Whether you're working to meet regulatory requirements, secure cyber insurance coverage, or proactively defend against evolving threats, vPenTest makes network penetration testing easy, affordable, and scalable. **Average Rating:** 4.6/5.0 **Total Reviews:** 243 #### Who Is the Company Behind vPenTest? - **Seller:** [Kaseya](https://www.g2.com/sellers/kaseya) - **Company Website:** www.kaseya.com - **Year Founded:** 2000 - **HQ Location:** Miami, FL - **Twitter:** @KaseyaCorp 17,411 Twitter followers - **LinkedIn® Page:** [www.linkedin.com](https://www.g2.com/external_clickthroughs/record?secure%5Bsource_type%5D=product_profile&secure%5Btoken%5D=6c9a31f82a811b1e3cc7be6babe8882bb8f6b2927e142d98dd6f5662a0d0e4d2&secure%5Burl%5D=https%3A%2F%2Fwww.linkedin.com%2Fcompany%2Fkaseya%2F&secure%5Burl_type%5D=linkedin_company_website) 5,471 employees on LinkedIn® #### Who Uses This Product? - **Who Uses This:** CEO - **Top Industries:** Information Technology and Services, Computer & Network Security - **Company Size:** 69% Small, 24% Medium #### What Do G2 Reviewers Say About vPenTest? _AI-generated summary from verified user reviews_ ##### Pros - Users find vPenTest **exceptionally easy to use** , enhancing efficiency and making penetration testing accessible for beginners. - Users appreciate the **awesome technical reports** from vPenTest, which provide detailed remediation steps and are reviewed by CREST. - Users value the **user-friendly interface** of vPenTest, enhancing navigation and improving pentesting efficiency significantly. - Users highlight the **setup ease** of vPenTest, appreciating its straightforward implementation and user-friendly interface. - Users value the **ease of implementation** of vPenTest, enjoying a seamless setup and effortless integration into workflow. ##### Cons - Users find the **setup process complex** , requiring multiple attempts and lacking integration with existing systems. - Users are frustrated by the **limited scope** of vPenTest, as it fails to address all pentesting needs effectively. - Users find vPenTest **expensive** , especially due to pricing models that burden smaller organizations and larger customer contracts. - Users note the **inadequate reporting** in vPenTest, highlighting issues with standardization and limited availability of reports. - Users note the **lack of detail** in vPenTest, which can lead to confusion and require additional explanations. #### What Are Recent G2 Reviews of vPenTest? **["Fast, Actionable Pen Testing Baselines with Clear, Customer-Ready Reports"](https://www.g2.com/survey_responses/vpentest-review-12881608)** **Rating:** 4.5/5.0 stars _— Darren ._ [Read full review](https://www.g2.com/survey_responses/vpentest-review-12881608) **["Great Product, Easy to Use, does exactly as described."](https://www.g2.com/survey_responses/vpentest-review-9009510)** **Rating:** 5.0/5.0 stars _— Kamran H._ [Read full review](https://www.g2.com/survey_responses/vpentest-review-9009510) ### [AI-Native Continuous Offensive Security Platform](https://www.g2.com/products/ai-native-continuous-offensive-security-platform/reviews) RidgeBot by Ridge Security is a leading agentic AI-driven offensive security platform, supporting continuous threat management programs. It enables CISOs to minimize cyber risks by continuously validating the cybersecurity posture and controls protecting attack surfaces against increasingly sophisticated and frequent attacks. RidgeBot automatically tests an organization’s entire IP-based environment, including network infrastructure, applications, websites, IoT, and OT, using ethical hacking techniques to pinpoint the most critical vulnerabilities. It's dynamic AI-powered decision-making supports DevSecOps, compliance, incident response verification, and custom attack simulations. RidgeBot maintains a library of over 36,000 plugins to launch complex penetration tests and attack simulations, with detailed reporting of results and remediation recommendations. **Average Rating:** 4.5/5.0 **Total Reviews:** 98 #### Who Is the Company Behind AI-Native Continuous Offensive Security Platform? - **Seller:** [Ridge Security Technology](https://www.g2.com/sellers/ridge-security-technology) - **Company Website:** ridgesecurity.ai - **Year Founded:** 2020 - **HQ Location:** Santa Clara, California - **Twitter:** @RidgeSecurityAI 1,291 Twitter followers - **LinkedIn® Page:** [www.linkedin.com](https://www.g2.com/external_clickthroughs/record?secure%5Bsource_type%5D=product_profile&secure%5Btoken%5D=f4ee553fba315e6da91ba8fe2c2763c183623acefb48c5a2db8aa8bcd2d740de&secure%5Burl%5D=https%3A%2F%2Fwww.linkedin.com%2Fcompany%2Fridge-security%2F&secure%5Burl_type%5D=linkedin_company_website) 47 employees on LinkedIn® #### Who Uses This Product? - **Top Industries:** Information Technology and Services, Computer & Network Security - **Company Size:** 51% Small, 45% Medium #### What Do G2 Reviewers Say About AI-Native Continuous Offensive Security Platform? _AI-generated summary from verified user reviews_ ##### Pros - Users appreciate the **ease of use** of RidgeBot, enabling quick setup and straightforward penetration testing automation. - Users value the **automation capabilities** of RidgeBot, significantly enhancing efficiency in penetration testing and vulnerability validation. - Users value the **high efficiency of RidgeBot's pentesting** , enabling quick, automated vulnerability validation and seamless integration. - Users commend RidgeBot for its **effective vulnerability identification** , providing reliable, automated testing and integration for security efficiency. - Users praise RidgeBot for its **efficiency** in automating vulnerability testing and streamlining security processes seamlessly. ##### Cons - Users find the **complex setup** of RidgeBot challenging, particularly for new admins requiring better documentation and support. - Users find RidgeBot's setup overly **complex** , particularly when working with customized or legacy systems. - Users find the **missing features** in RidgeBot, such as limited reporting and API testing, hinder optimal usage. - Users find **poor customer support** frustrating, often lacking resources for resolving issues independently. - Users find the **poor documentation** of RidgeBot challenging, especially for new admins during setup and onboarding. #### What Are Recent G2 Reviews of AI-Native Continuous Offensive Security Platform? **["Powerful Vulnerability Assessment and Remediation Capabilities"](https://www.g2.com/survey_responses/ai-native-continuous-offensive-security-platform-review-12910247)** **Rating:** 5.0/5.0 stars _— Daniel Felipe P._ [Read full review](https://www.g2.com/survey_responses/ai-native-continuous-offensive-security-platform-review-12910247) **["Powerful and Efficient, Although It Requires Manual Validations"](https://www.g2.com/survey_responses/ai-native-continuous-offensive-security-platform-review-12940521)** **Rating:** 4.5/5.0 stars _— Henry A._ [Read full review](https://www.g2.com/survey_responses/ai-native-continuous-offensive-security-platform-review-12940521) ### [Simulations Labs](https://www.g2.com/products/simulations-labs/reviews) Simulations Labs is an ai-powered platform that enables organizations, educators, and security teams to create realistic, reusable, and scalable hands-on cybersecurity simulations—without complex setup or infrastructure. Fully Managed Hosting Without Infrastructure Overhead Organizations run CTFs and simulations without DevOps, server setup, or maintenance. No Worries About Attacks or Server Downtime Simulations Labs automatically manages security, monitoring, and uptime, even during large-scale events. Organizers don’t need to worry about servers being attacked, crashing, or going offline. Custom Simulation Creation with Dashboard Simulations Labs offers a dashboard that allows organizers to create and manage fully custom simulations. Each simulation provisions isolated environments for participants, supports web application challenges, and can include dynamic flags to prevent cheating AI-Powered Challenge Creation Unlike traditional platforms that require technical expertise, our AI-powered tools enable non-technical users to create simulations and challenges quickly and easily. **Average Rating:** 4.8/5.0 **Total Reviews:** 10 #### Who Is the Company Behind Simulations Labs? - **Seller:** [Simulations Labs](https://www.g2.com/sellers/simulations-labs) - **HQ Location:** N/A - **LinkedIn® Page:** [www.linkedin.com](https://www.g2.com/external_clickthroughs/record?secure%5Bsource_type%5D=product_profile&secure%5Btoken%5D=a2c09aa8f75a5be17b384db5c4d513818f1631cccd83db32e68cb22454bb9e6f&secure%5Burl%5D=https%3A%2F%2Fwww.linkedin.com%2Fcompany%2Fsimulation-labs-linkedin%2F&secure%5Burl_type%5D=linkedin_company_website) 1 employees on LinkedIn® #### Who Uses This Product? - **Company Size:** 100% Small #### What Are Recent G2 Reviews of Simulations Labs? **["CTF Platform"](https://www.g2.com/survey_responses/simulations-labs-review-11774124)** **Rating:** 4.5/5.0 stars _— Verified User in Computer & Network Security_ [Read full review](https://www.g2.com/survey_responses/simulations-labs-review-11774124) **["ASA Awareness CTFs Review"](https://www.g2.com/survey_responses/simulations-labs-review-11772604)** **Rating:** 4.0/5.0 stars _— Mubiito G._ [Read full review](https://www.g2.com/survey_responses/simulations-labs-review-11772604) ### [Defendify All-In-One Cybersecurity Solution](https://www.g2.com/products/defendify-all-in-one-cybersecurity-solution/reviews) Founded in 2017, Defendify is pioneering All-In-One Cybersecurity® for organizations with growing security needs, backed by experts offering ongoing guidance and support. Delivering multiple layers of protection, Defendify provides an all-in-one, easy-to-use platform designed to strengthen cybersecurity across people, process, and technology, continuously. With Defendify, organizations streamline cybersecurity assessments, testing, policies, training, detection, response & containment in one consolidated and cost-effective cybersecurity solution. 3 layers, 13 solutions, 1 platform, including: • Managed Detection & Response • Cyber Incident Response Plan • Cybersecurity Threat Alerts • Phishing Simulations • Cybersecurity Awareness Training • Cybersecurity Awareness Videos • Cybersecurity Awareness Posters & Graphics • Technology Acceptable Use Policy • Cybersecurity Risk Assessments • Penetration Testing • Vulnerability Scanning • Compromised Password Scanning • Website Security Scanning See Defendify in action at www.defendify.com. **Average Rating:** 4.7/5.0 **Total Reviews:** 57 #### Who Is the Company Behind Defendify All-In-One Cybersecurity Solution? - **Seller:** [Defendify](https://www.g2.com/sellers/defendify) - **Year Founded:** 2017 - **HQ Location:** Portland, Maine - **Twitter:** @defendify 305 Twitter followers - **LinkedIn® Page:** [www.linkedin.com](https://www.g2.com/external_clickthroughs/record?secure%5Bsource_type%5D=product_profile&secure%5Btoken%5D=43c15ef0c3df55163faa1afeb1111d8c8a808e2ecdcdbfdef9a0cfa63c68564d&secure%5Burl%5D=https%3A%2F%2Fwww.linkedin.com%2Fcompany%2F11098948%2F&secure%5Burl_type%5D=linkedin_company_website) 37 employees on LinkedIn® #### Who Uses This Product? - **Top Industries:** Information Technology and Services, Computer & Network Security - **Company Size:** 65% Small, 35% Medium #### What Do G2 Reviewers Say About Defendify All-In-One Cybersecurity Solution? _AI-generated summary from verified user reviews_ ##### Pros - Users highlight the **ease of use** of Defendify, streamlining cybersecurity management for organizations with limited resources. - Users praise Defendify for its **comprehensive and cost-effective cybersecurity features** , streamlining management for small and medium-sized businesses. - Users appreciate the **easy setup** of Defendify, making configuration and onboarding quick and efficient. - Users value the **ease of use** of Defendify, enabling quick setup and clear insights into cybersecurity posture. - Users value the **continuous monitoring** and ease of use of Defendify, enhancing their network security significantly. ##### Cons - Users note that the **reporting is inadequate** , desiring improvements like concise summaries and detailed penetration testing results. - Users feel the **reporting could be improved** , expressing a need for more concise and detailed reports. - Users feel the **lack of information** in reports diminishes clarity and thoroughness of penetration testing insights. - Users find the **limited customization** options restrictive, desiring more flexibility in reports and branding features. - Users find the lack of **custom reporting options** limits their ability to tailor insights for future needs. #### What Are Recent G2 Reviews of Defendify All-In-One Cybersecurity Solution? **["Comprehensive and robust protection"](https://www.g2.com/survey_responses/defendify-all-in-one-cybersecurity-solution-review-10560878)** **Rating:** 4.5/5.0 stars _— Verified User in Computer & Network Security_ [Read full review](https://www.g2.com/survey_responses/defendify-all-in-one-cybersecurity-solution-review-10560878) **["Perfect Vulnerability Management for Software Companies"](https://www.g2.com/survey_responses/defendify-all-in-one-cybersecurity-solution-review-10488301)** **Rating:** 4.5/5.0 stars _— Akhil V._ [Read full review](https://www.g2.com/survey_responses/defendify-all-in-one-cybersecurity-solution-review-10488301) #### What Are G2 Users Discussing About Defendify All-In-One Cybersecurity Solution? - [What is Defendify Cybersecurity Platform used for?](https://www.g2.com/discussions/what-is-defendify-cybersecurity-platform-used-for) Spotlight Categories [Experience Management Software](https://www.g2.com/categories/experience-management) [Analytics Platforms](https://www.g2.com/categories/analytics-platforms) [Sales Training and Onboarding Software](https://www.g2.com/categories/sales-training-and-onboarding) [Partner Relationship Management (PRM) Software](https://www.g2.com/categories/partner-relationship-management-prm) [AI Writing Assistants](https://www.g2.com/categories/ai-writing-assistant) Similar Categories - [Incident Response](/categories/incident-response) - [Security Information and Event Management (SIEM)](/categories/security-information-and-event-management-siem) - [Threat Intelligence](/categories/threat-intelligence) - [AI SOC Agents](/categories/ai-soc-agents) - [Deception Technology](/categories/deception-technology) - [Digital Forensics](/categories/digital-forensics) - [Digital Risk Protection (DRP) Platforms](/categories/digital-risk-protection-drp-platforms) - [IoT Security Solutions](/categories/iot-security-solutions) - [Malware Analysis Tools](/categories/malware-analysis-tools) - [Managed Detection and Response (MDR)](/categories/managed-detection-and-response-mdr) - [OT Secure Remote Access](/categories/ot-secure-remote-access) - [OT Security Tools](/categories/ot-security-tools) - [Red Teaming Tools](/categories/red-teaming-tools) - [Security Orchestration, Automation, and Response (SOAR)](/categories/security-orchestration-automation-and-response-soar) [Browse Breach and Attack Simulation (BAS) Themes](/categories/breach-and-attack-simulation-bas/themes)