Get a Demo
Menu

Step 4 of 5: Validation

Test exposures with simulations, red teaming exercises, and attack path modeling to understand real world impact potential.

Try the working example Download the PDF
The 5 steps as a cycle, with step 4, Validation, marked. Each step links to its page.

Goal

Confirm exploitability

The challenge

How do you know what’s real before it becomes real?

What makes it hard
  • Simulations are resource intensive and can fall to more pressing matters
  • Full attack chains are often technically difficult to implement
  • Testing can potentially disrupt production environments and teamwork

How Axonius helps

It starts and coordinates the tests; your BAS service or red team runs them.

How do workflows start validation?

Axonius Workflows automate actions whenever assets or exposures meet a condition.

Orange panel: "Validate exploit path when a new asset starts accepting internet traffic". Screenshot of the Axonius Enforcement Center workflow "When A New Asset Gets A Public IP, Pentest It!": a Trigger (Event, Asset added) leading to an Action (Jira Service Management). Right pane "Trigger Type": Event (Event based action) or Scheduled (Time based repeat action); "Asset added or removed" with Asset added selected; Select Query: Devices, "FH: 3.1 Asset Context.Exposure.Devices with public internet traffic".
A workflow that starts a pen test when a new asset accepts internet traffic.

Pick who runs the test to follow the loop:

  1. Axonius

    A new asset starts accepting internet traffic.

  2. Axonius workflow

    BAS service: Triggers a task run in your BAS service for an automatic pen test.

    Red team: Opens a ticket with your red team for a manual pen test.

  3. Your BAS service

    Your red team

    Runs the test. Axonius does not run BAS or pen tests itself.

  4. Axonius adapters

    BAS service: Confirm the task is done, such as Exploit Verified from Pentera.

    Red team: Confirm the red team finished the test.

  5. Axonius

    The confirmation feeds queries, risk scores and mobilization.

Axonius runs every step of the loop but the middle one.
Read the full section

While Axonius does not support native validation capabilities like Breach and Attack Simulation (BAS) or Pentest as a Service, the platform automates the start and coordination of the validation process through workflows.

In the context of validation, workflows can be used for triggering a task run in your Breach and Attack Simulation (BAS) service for an automatic pen test or opening a ticket with your red team for manual pen testing with the targeted asset or exposure.

How do adapters confirm validation?

Axonius adapters can confirm the completion of validation tasks from your red team and BAS services.

Orange panel: "Using Exploit Verified from Pentera as a validation confirmation signal". Screenshot of a query on Show Devices: WHERE NOT ALL Pentera Task Run ID exists; AND NOT ALL Vulnerable Software exists; AND NOT ALL ID exists. A field search for "exploit" lists All Fields, Common, Specific, with results "Vulnerable Software: Exploit Verified", "Excluded Vulnerable Software: Exploit Verified" and "Vulnerable Software: Is Exploit".
Exploit Verified from Pentera used as a confirmation signal.
Read the full section

Like any other data in Axonius, data like exploit confirmations can be used across queries, risk prioritization, and to drive mobilization.

Adapters can be used to bring confirmation signals not only from your own infrastructure (BAS tools) but also from other sources like Threat Intelligence Feeds.

From pages 21 to 22 of the PDF. Download the PDF