Automated adversary emulation platform
Adversary emulation platform created by MITRE, now in the Apache organisation on GitHub, that runs ATT&CK-mapped operations through agents to test defences.
Caldera automates adversary emulation: operators choose an adversary profile built from abilities mapped to MITRE ATT&CK techniques, and agents on test hosts execute them while Caldera tracks results. Plugins add capabilities such as manual operations, training and reporting.
It was created by MITRE; the repository now lives under the apache organisation on GitHub. As a dual-use tool, it should only run in environments where the operation is authorised.
Apache-2.0 · Apache License 2.0 · Open source
Checked by ThreatWire against the repository's licence file on 2026-10-20. GitHub detects: Apache-2.0.
No published advisory found for Caldera in GitHub repository advisories. That does not mean the tool has no vulnerabilities.
Sources: GitHub repository advisories · checked 2026-10-20.
Small detection tests mapped to MITRE ATT&CK
Red Canary's library of small, portable tests mapped to MITRE ATT&CK techniques, used to check whether detections and logging work.
Penetration testing framework
Rapid7's open-source framework for developing, testing and running exploit modules and auxiliary checks in authorised security assessments.
Phishing simulation framework for awareness programmes
Open-source framework to run authorised phishing simulation campaigns, with templates, landing pages, scheduling and result tracking.
