Offensive testing activities that replicate realistic attack scenarios to evaluate the resilience of systems, networks, and applications. Includes red teaming, breach and attack simulation (BAS), adversary emulation, and simulated phishing campaigns. Allows measuring the effectiveness of security controls, SOC detection and response capabilities, and staff preparedness in the face of concrete threats.