Secureworks Adversary Simulation

Secureworks Adversary Simulation is a professional service that reproduces the behavior of real threat actors in a controlled way, so an organization can measure how well it detects and responds to an attack. It is delivered by the Secureworks Adversary Group, now part of Sophos, and is often run as a collaborative purple team exercise alongside the customer's own security operations staff.

Scenarios are built from threat intelligence collected by the Secureworks Counter Threat Unit and from real incident response cases, and they are mapped to MITRE ATT&CK. Testers execute specific techniques such as initial access, credential theft, lateral movement and data exfiltration while defenders watch their SIEM, EDR and XDR tooling to see what is detected, which alerts fire and how quickly the team reacts. Detection gaps are recorded and tuning advice is given during and after the exercise.

The service helps teams validate security tooling, improve detection rules, train SOC analysts on realistic attacks and show leadership and regulators that security investments are working.