What are the models?
| Model | What it is | Fits when |
|---|---|---|
| One-off baseline | A single bounded exercise with a report | You have never tested detection end to end |
| Recurring programme | Scheduled exercises with a shared backlog | Your environment or threats change often |
| BAS-assisted | Automated runs of known techniques between human-led exercises | You need cheap, frequent regression checks |
How often?
We found no standard that sets a cadence, so decide by drift. Rerun after a major change: a new SIEM or EDR, a cloud migration, a new log source, or a relevant incident. The Mandiant datasheet describes a continuous variant with coaching sessions at regularly scheduled intervals, which shows how a provider frames the recurring model. See the Mandiant profile.
Is it worth the cost?
It is when the results change something. If each exercise ends in a gap list that nobody closes, repetition adds cost without improvement. A retest built in, as the Wattlecorp profile describes, makes the value visible. For cost drivers, see the scoping guide.
Build in-house or outsource?
A mix works. An outside provider brings scenarios from its own intelligence and experience. An in-house team keeps the knowledge. Many organisations outsource the baseline and bring the repeat tests in-house with open tools described in the tools guide.
Can BAS replace human-led work?
No. BAS repeats what it was given. A human decides what matters, adapts to what defenders see and explains a miss. Use BAS for regression and people for new scenarios.
What maturity is needed?
Enough to act on findings: log sources in place, someone who can change detections and a way to track fixes. Without those, start with the basics and revisit. How to measure progress is in measuring purple team results.