> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/crto/getting-started/adversary-emulation-vs-simulation.md).

# Adversary Emulation vs Simulation

The have different approaches and achieve different outcomes.

| Emulation                                                        | Simulation                                                     |
| ---------------------------------------------------------------- | -------------------------------------------------------------- |
| <ul><li>Emulate a specific threat.</li></ul>                     | <ul><li>Simulate a hypothetical threat.</li></ul>              |
| <ul><li>Leverage their known TTPs.</li></ul>                     | <ul><li>Leverage unknown or unique TTPs.</li></ul>             |
| <ul><li>Narrow in scope.</li></ul>                               | Broad in scope.                                                |
| <ul><li>Enhance defences against that specific threat.</li></ul> | <ul><li>Enhance defences against a range of threats.</li></ul> |

***Adversary Emulation***&#x20;

* Is to develop, test and tune an organisation's ability to detect and respond to the TTPs of a specific threat.
* This provides a focused evalution of their capabilities against a threat actor that is more likely to target them. In these scenarios, the red team will leverage threat intelligence (TI) reports to mirror the known TTPs of that actor as closely as reasonably possible.

\
\&#xNAN;***Adversary Simulation***

* Allows the red team to behave like a completely hypothetical threat, which is less restrictive in terms of the TTPs they can leverage.
* This provides an organisation with a broader evalutation of their capabilites and can highlight lesser-known blind spots.

> ***Note***: A common strategy for organisations to employ is to leverage adversary emulation to set a baseline capability, and then use adversary simulation to imporve that capability against more advanced or a wider variety of TTPs.