At BSides San Francisco 2025 I have run a workshop where people emulated real threat actors in a lab with AV, EDR and web proxies in place.
We covered what a mature emulation programme is made of: threat intelligence, emulation planning, threat hunting, custom simulations, and checking whether the controls you already own are doing their job.
