Adversary Simulation
Long campaigns, C2 OPSEC, custom tooling. Adversary emulation as a craft, not a script-kiddie sport.
Tiny market. Best done from a senior red-team seat, not as a first offensive job.
Read the full role verdict and reasoning
Adversary simulation evaluates defensive assumptions through agreed, controlled exercises.
- Domain
- Cybersecurity
- Entry
- Not mapped
- Senior
- Not mapped
- You've done pentest or red team work and want long-form campaigns instead
- You can plan and execute over months, not days
- You enjoy the collaboration with detection and IR teams
- You're motivated by improving defence, not just landing shells
- You want fast feedback loops, this isn't that
- You see purple teaming as compromise, you'll resent the seat
- You haven't done red or pentest work yet, you're not ready
What "doing well" looks like in the seat
- Your TTPs evolve based on what the blue team learns
- Your campaigns produce detection content that ships
- You can write a report defence teams will still reference next year
- You're trusted to scope your own engagements
A useful exercise needs a decision objective, operating limits and a feedback session. Tool execution alone does not establish improved defensive capability.
Tradeoffs at a glance
Open a tradeoff for its meaning. Ratings are directional, not absolute.
Promotion ceiling
Lead Red Team / Adversary Sim; very narrow market beyond senior IC.
Who actually gets in
- +Pentester (senior)
- +Red teamer
- +Malware developer
Common misconceptions
- −That adversary simulation is 'just red team'. It's measured against specific TTPs, not just engagement outcomes.
Where this leads
- Red Team
- Pentester
- Detection Engineering (purple)
Certifications people pair with this
Listed because the graph connects them to this role, not because you need all of them. Most practitioners pick one or two.
Pathways that pass through here
What this is based on
Editorial route and career guidance. No separate external evidence review is recorded for this assessment.
Editorial evidence review: pending · UK market. Vendor facts and prices elsewhere on this page have their own sources and check dates.