Caldera is an automated adversary emulation platform that enables security teams to simulate attacks, support red team operations, and automate incident response testing.
The platform addresses the need to systematically test defenses by automating adversary behavior based on the MITRE ATT&CK framework. It operates as a core system consisting of an asynchronous command-and-control server with a REST API and web interface, designed to be extended through a plugin architecture. This modular approach allows organizations to add agents, reporting tools, technique libraries, and specialized capabilities without modifying the core framework.
Organizations should adopt this tool if they need to conduct regular adversary emulation exercises, validate detection capabilities, or automate incident response workflows. It suits security teams ranging from those building custom red team operations to those seeking structured, framework-aligned testing. The platform runs on Linux or macOS with Python 3.10 or later, requiring modest hardware resources. The plugin ecosystem includes default supported plugins maintained by the core team covering initial access, payload compilation, operational insights, and visualization, alongside community-contributed plugins for specialized domains like industrial control systems and MITRE ATLAS techniques.
The project maintains active development with regular updates to core functionality and plugin support. The framework receives ongoing enhancements to its command-and-control capabilities and user interface components. The plugin ecosystem continues to expand with both officially maintained and community-contributed extensions. Documentation and training resources are actively maintained alongside the codebase to support adoption and operational use.
