Threat Simulator

Safe, simulated OWASP Top 10 attack scenarios that validate your detection coverage — no real payloads leave your environment.

Overview

Threat Simulator runs the OWASP Top 10 attack categories against your application as safe, simulated scenarios and reports whether each one was Detected or Missed by your current monitoring stack. Every request carries a recognisable marker so your own detection tooling (like Traffic Monitor and Audit Trail) can distinguish simulator traffic from real attacks.

Simulated, not real

Threat Simulator does not send real exploit payloads to external systems. It generates the request patterns an attack would produce and checks whether your stack correctly flags them — no real damage, no real data exfiltration.

Quick Start

Open Threat Simulator from the Security sidebar.
Click Run Full OWASP Suite to run all ten scenario categories, or select a single row and click Run to run just that scenario.
Watch each scenario move from Not run to Running… to Detected or Missed.
Click any scenario row to see its description and result detail in the right-hand panel.
Check the stat strip at the top for overall Detection Coverage, and how many scenarios were detected vs. missed.

OWASP Top 10 Coverage

#	Category	Simulated scenario
A01	Broken Access Control	IDOR probing, privilege escalation via path manipulation, CORS misconfiguration test
A02	Cryptographic Failures	Weak cipher negotiation, unencrypted cookie detection, TLS downgrade attempt
A03	Injection	SQL injection payloads (time-based, error-based), NoSQL operator injection, command injection
A04	Insecure Design	Business logic bypass patterns, mass assignment probing, rate-limit absence test
A05	Security Misconfiguration	Default credentials, exposed admin panels, verbose error messages, directory listing
A06	Vulnerable Components	Known-CVE endpoint probing, outdated version fingerprinting via response headers
A07	Authentication Failures	Brute-force simulation, credential stuffing patterns, JWT algorithm confusion
A08	Software Integrity Failures	Unsigned update endpoint detection, subresource integrity check
A09	Logging Failures	Checks whether attack attempts appear in Audit Trail and Traffic Monitor logs
A10	SSRF	Internal metadata endpoint probing patterns, DNS rebinding indicators

Features

Run All or One

Run the full OWASP Top 10 suite in sequence, or trigger a single scenario from its row for a fast spot-check.

Detection Coverage

The stat strip shows overall detection coverage as a percentage, plus counts of detected, missed, and not-yet-run scenarios.

Safe by Design

Every simulated request carries an X-TotalApp-Sim: true header so your own monitoring and logging tools can distinguish it from real attack traffic.

AI Assistant

Every screen in Security Hub now ships with an embedded AI Assistant, opened from the vertical AI Assistant tab on the right edge of the screen. The assistant reads the data currently on screen — the OWASP Top 10 scenario list, including which categories were Detected and which were Missed — and answers questions, triages findings, or drafts a remediation plan directly in the chat panel.

Coverage Summary

Get a plain-language summary of your current detection coverage — how many scenarios were caught vs. missed, and the resulting percentage.

Missed-Scenario Explanation

Understand why a specific scenario was missed and what kind of attack pattern slipped through undetected.

Next Steps

Get concrete recommendations — a WAF rule, a tighter rate limit, added input validation — to close a specific detection gap.

Save as Report & Add Knowledge

Any assistant reply can be saved as a report (available later from My Reports) via the Save as Report button under the last message. Click Add Knowledge in the input dock to attach files or notes from your Knowledge library so the assistant's answers can reference them.

FAQ

Is this a replacement for a professional penetration test?

No. Threat Simulator validates known attack patterns against your detection stack continuously and quickly. A professional penetration tester brings creative, context-specific attack chains that no automated tool fully replicates — use Threat Simulator between formal pen tests to verify your baseline coverage hasn't regressed.

Can I run Threat Simulator against production?

Technically yes — all requests carry the X-TotalApp-Sim: true marker so you can filter them out of production metrics — but running against a staging environment first is recommended, since some WAF rules may still trigger rate-limit responses that affect real traffic.