FIT3211 · Adversary simulation and emulation

Overview

This unit introduces the principles and practices of adversary simulation and adversary emulation as approaches to evaluating and improving organisational security. It focuses on understanding how attackers operate through tactics, techniques, and procedures (TTPs), and how these behaviours can be systematically reproduced using structured attack frameworks in controlled environments. You will learn how to apply adversary simulation techniques to execute and analyse individual attack behaviours to test and validate detection and defensive controls. Building on this, you will learn how to design and conduct adversary emulation scenarios that replicate the behaviour of real-world threat actors across multiple stages of an attack lifecycle. You will also learn how to translate threat intelligence into structured and executable adversary scenarios, and produce findings that inform improvements to organisational security controls, while adhering to ethical and professional standards.

Offerings

The Handbook publishes no offerings for this unit.

Assessment

The Handbook publishes no assessment items for this unit yet.

Assessment details may change. Please refer to the assessment information in Moodle closer to the start of the teaching period.

Requisites

Learning outcomes

1. Analyse threat intelligence and adversary behaviours to identify relevant tactics, techniques, and procedures (TTPs) and map them to structured attack frameworks;
2. Design and apply adversary simulation techniques and adversary emulation scenarios to model attacker objectives, decision-making, and sequences of TTPs;
3. Evaluate the effectiveness of detection and response capabilities by analysing security telemetry, identifying gaps in defensive coverage based on simulated or emulated adversary activity, and recommending improvements to organisational security controls and processes;
4. Apply ethical, legal, and professional principles when conducting adversary simulation and emulation activities, ensuring the protection of sensitive information and responsible handling of data.

Workload

No workload detail published.

Student experience, not official rules. Nothing here changes what the Handbook says.