Attackers are using advanced and novel AI models to target organizations with greater speed, scale, and sophistication. Defenders are still validating their security with point-in-time tests and disconnected tools. That gap is why we built GreyMatter Attack.
Its agentic attack-path mapping and validation is built directly into the GreyMatter agentic AI security operations platform, allowing defenders to use AI to attack their own environments, find gaps in security posture, and close them before adversaries can exploit them, all without leaving GreyMatter.
The Validation Loop Never Closes
Most organizations still rely on point-in-time and periodic testing to find out whether their defenses will hold up against a real attack. The methods used though have blind spots:
Penetration tests give a narrow, point-in-time assessment.
Red team engagements are expensive, infrequent, and hard to scale.
Tabletop exercises are mostly hypothetical.
Exposure and vulnerability management tools bury teams in disconnected findings.
Breach and attack simulation (BAS) tools rely on predefined technique libraries and often stop at visualization or isolated tests.
A skilled red team can find real attack paths, but those findings are a snapshot that starts expiring as soon as the engagement ends. Most of these methods don't connect their findings to the detections and responses that are supposed to stop them. Remediation happens outside the process, so the validation loop never fully closes, while the adversary keeps moving at machine speed.
What Is GreyMatter Attack?
GreyMatter Attack runs campaigns against your environment the way a real, intel-driven adversary would. Then, it grades and strengthens how GreyMatter detects and responds.
Teams can build a campaign from threat advisories in GreyMatter Intel, a plain-language description, premade scenarios built by our red team, uploaded penetration test reports, and more. From there, Attack follows six stages:
Context Graph: GreyMatter already knows your identities, assets, clouds, and detections. Attack builds on that live Context Graph.
Attack Campaign: Pick a scenario or seed one from current GreyMatter threat intelligence.
Attack Path Mapping: Attack maps the paths an adversary is most likely to take and lays them out in a Campaign Plan you review and edit in plain language before launching.
Attack Execution: The Attacker runs the approved campaign under your Rules of Engagement.
Prioritized Insights: Results are scored and ranked by real-world impact.
Agentic Defense: Every gap comes with a recommendation tied to a specific GreyMatter object, so you can close it with detections, hunts, playbooks, and remediation inside the platform.
Two Agents, One Fence
GreyMatter Attack uses two agents with very different jobs.
The Marshal works on the GreyMatter side. It builds the model of your environment, proposes the attack path, assembles the Campaign Plan, and scores the results after the run.
The Attacker is the adversary. It only ever sees the approved Campaign Plan and what additional information the Marshal decides to share with it. It never sees your detections, incidents, or coverage. That means every finding it brings back was earned blind, in the same way a real adversary would.
When the campaign finishes, a deterministic engine outside any model matches what the Attacker did to GreyMatter’s detection and response capabilities, and the Marshal produces three scores:
Red / Exposure: How far the Attacker got.
Blue / GreyMatter: How well your defense performed at each step: covered by a rule, detected, escalated, and responded.
Purple / Coverage: The headline coverage percentage, weighted by technique severity and asset criticality, plus a ranked list of gaps. It's the number you can use to track your environments defenses over time.
In addition to providing these scores, GreyMatter Attack automatically correlates attacks it executes. When a detection is triggered by authorized testing, GreyMatter automatically remediates the finding as “Security Control Testing.” This prevents test-generated findings from adding unnecessary noise, allowing customers to run agentic red team testing without manually reviewing and closing the resulting detections.
From Plan to Attack
Every campaign starts with a plan. The Marshal lays out how an attack against your environment would most likely unfold, and you review and edit that Campaign Plan in plain language. You can stop there and act on what the plan shows or launch the campaign and run the attack for real under your Rules of Engagement. The Attacker treats the plan as a starting point and can deviate, but any new branch pauses for human approval.
Safety controls are built into the infrastructure, not left to the model. A code-enforced no-go list and Rules of Engagement block off-limits hosts, identities, and techniques outside the Attacker. Human gates control when the destructive phases move forward. Every action is logged for audit. Incidents the run generates close automatically with an audit note, so your analysts aren't triaging test noise.
Core Use Cases
Validate new detections: Detection engineers run a campaign against a new rule to confirm it fires on the right technique chain.
Respond to new threats fast: SOC leaders go from a GreyMatter threat advisory to a configured campaign in one click.
Confirm the fix worked: After remediation, teams re-run a single attack path and get a delta scorecard showing whether the gap is closed.
Track what changed: The "What changed since" view re-checks every gap against current GreyMatter state without re-running the campaign.
Pentest Validation: Upload Pentest reports to rerun those attacks against your environment to determine if the gaps identified have been remediated.
Remediation: Once you finish running an attack, you can automatically remediate those findings using our Agentic Teammates.
Key Benefits
Continuous Validation: Run intel-seeded campaigns against current threats, then track your scores as they trend over time instead of waiting for the next annual test.
Risk-Adjusted Execution: Review the plan before anything runs, set autonomy and Rules of Engagement, and keep a human in the loop where it counts.
Recommendation Remediation: Attacks are executed within GreyMatter. We know what was caused by testing and we close it out, so your team does not have to.
Built Into GreyMatter, Not Bolted On
Pen tests, red teams, and BAS tools show that an attack can execute, then hand you a report. GreyMatter Attack goes further. It grades your own GreyMatter detection and response, points every gap at the GreyMatter object you need to fix, remediates findings by deploying detections and automated response playbooks, then re-validates the fix on the next run.
Because Attack is native to GreyMatter, there's no new console to learn and no handoff between tools. The same platform that runs your security operations attacks your environment, finds the gaps, and closes them.
It's time to think like an attacker and act like a defender.
