Can this path be reached?
Run an approved test against the path and see whether the expected control actually stops it.
VitalSec platform
CAAT
Continuous Automated Adversarial Testing
Test whether the control actually works.
CAAT turns an expected security outcome into a controlled test, runs it against an approved target, and records whether the control passed, failed, or could not be determined from the evidence.
Why CAAT matters
Configured is not the same as effective.
A policy can exist. A dashboard can show green. A configuration can look correct. CAAT asks the practical question: what happens when the control is actually tested?
Does the control work the way we think it does?
Test the real behavior instead of assuming a green configuration means the control is effective.
What happens when we test it?
Use a defined target, time window, and safety limits so the test stays deliberate and controlled.
How a CAAT test runs
See how controls respond to adversarial tests.
Every run keeps the approval, target, expected result, observed response, final result, and evidence together so the same test can be repeated later.
01
Authorize the scope
Testing is limited to your approved systems, scenarios, time window, and safety limits.
02
Set the expected response
Each scenario specifies how the control being tested should respond.
03
Execute the scenario
CAAT runs the approved test within those limits.
04
Capture the response
The run records how the control responded and the evidence supporting that observation.
05
Assess the outcome
The observed response is compared with the expected result: PASS, FAIL, or INCONCLUSIVE.
06
Retain the evidence
Evidence Continuity retains the test record; failed controls enter the remediation workflow.
Test results
Not every test has a clean answer.
Incomplete or conflicting evidence produces an INCONCLUSIVE result, with the uncertainty retained for review.
PASS
The control behaved as expected within the scope of this test.
FAIL
The control did not behave as expected and the result should become remediation work.
INCONCLUSIVE
There is not enough reliable evidence to call the test pass or fail. CAAT keeps that uncertainty visible.
Example tests
Endpoint control
Does endpoint protection stop this approved test behavior on this host?
TEST 1Identity path
Can this user or identity path reach the protected resource under the tested condition?
TEST 2Network exposure
Does the intended boundary block or contain the approved connection attempt?
TEST 3Retest after a fix
After remediation, does the same test now produce a different result?
TEST 4Repeatable testing
Retest controls after a fix or configuration change.
CAAT can rerun the same defined test after remediation, a configuration change, or normal drift.
Compare the results before and after remediation to verify whether the control now responds as expected.
Safety and scope
CAAT only tests what has been approved.
CAAT is not unrestricted penetration testing or destructive attack automation.
Each run stays within the approved environment, targets, time window, test profile, and permissions.
Passive observation is not presented as an active CAAT test result.
Permission to test one environment never carries over automatically to another customer or environment.
Failed tests create remediation work. Every completed test leaves evidence.
VUMA receives the remediation work. Evidence Continuity keeps the test question, what CAAT observed, and the resulting evidence.