- BFSIBanking, Financial Services & Insurance
- IT & ITESIT services, BPM, GCCs & SaaS
- Retail & e-commerceStore chains, D2C brands & marketplaces
- HealthcareComing soon
- ManufacturingComing soon
Aquila I Adversarial Exposure Validation (BAS)
Your EDR passed its acceptance test on the day it went live. Nobody has checked it against this year’s techniques — Aquila I BAS replays MITRE ATT&CK attack chains against your own controls — EDR, WAF, firewall, email and web gateways, cloud and DLP — and shows which ones detect, which block and which stay silent.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Quick answer
The Aquila I platform family
This page covers Aquila I Adversarial Exposure Validation (BAS) — control validation from the inside. The rest of the platform:
Quick facts
30-second orientation- Product
- Breach and attack simulation that tests whether your security controls detect and stop ATT&CK techniques
- Maker
- Aquila I Solutions Pvt. Ltd., Thane (Mumbai Metropolitan Region); founded 2020; no outside funding reported (Tracxn)
- Platform
- The validation layer of Aquila I’s platform beside CART; results feed its Security Data Lakehouse
- Price
- Quote-only; no published price, no INR list and no public licence meter
- Deployment
- Cloud-native SaaS by Aquila I’s account; agents or simulators needed on endpoints are not documented
- Controls tested
- EDR, WAF, firewall, cloud, email gateway, web gateway and DLP, per Aquila I’s product page
- Customers
- Aquila I publishes no named customer case studies, for BAS or for any other product
- Analysts
- No analyst placement for Aquila I; the product name borrows the adversarial exposure validation category
- India
- Indian-built, but the SaaS hosting region is not published; India origin is not data residency
- In India via
- TechBag — scoping, the hosting region in writing, a quote in INR with GST, pilot support
Understand breach and attack simulation before you buy it
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is breach and attack simulation?
It safely replays attacker techniques against your own controls to see which ones detect and block them.
Controls trusted since go-live vs Aquila I BAS — the honest table
What consolidation actually replaces, dimension by dimension.
| Dimension | Controls trusted since go-live | Aquila I Adversarial Exposure Validation (BAS) |
|---|---|---|
| How controls are checked | Assumed to work after go-live | Tested against ATT&CK techniques on a schedule |
| Configuration drift | Found during an incident | Flagged when a repeat simulation fails |
| What gets tested | One control at a time, by its own vendor | EDR, WAF, firewall, gateways and DLP together |
| SOC readiness | Measured in a yearly tabletop exercise | Alerting, escalation and response checked per run |
| Board reporting | A list of tools owned | Exposure scores and trends against a baseline |
| What it is NOT | — | A red team, a VAPT report or a published price |
The cheapest test is one segment: run the attack chains against it for a month and compare what was blocked with what your SOC actually saw.
The four pieces of the platform
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
Scenarios
Multi-stage chains follow an attacker from initial access through execution, persistence, privilege escalation and lateral movement to exfiltration, mapped to MITRE ATT&CK.
Execution
Aquila I says simulations run within controlled boundaries across endpoints, network, cloud, email and apps; what you install to host them is not documented, so ask.
Lakehouse
BAS is built on Aquila I’s Security Lakehouse: results are correlated with telemetry and, by Aquila I’s account, enter the lakehouse as a detection benchmark.
Scoring
Exposure analytics weigh simulated attack success and control-coverage gaps to rank fixes, then track scores and detection accuracy against a baseline over time.
Attack chains run inside your estate — each result scored, ranked and kept in Aquila I’s Security Data Lakehouse.
Nine capabilities. Simulate, validate, measure.
Aquila I BAS tests the controls you already own against the techniques attackers already use — on a schedule, not once a year.
Technique coverage across the chain
Validates defences against initial access, execution, persistence, privilege escalation, lateral movement and exfiltration techniques.
Multi-stage attack paths
Models an adversary moving across security layers, to find chained weaknesses rather than one isolated control gap at a time.
Ransomware and exfiltration chains
Simulates exfiltration techniques and ransomware progression to see whether prevention and response work together when it counts.
EDR detection and containment
Measures detection accuracy, privilege-escalation visibility and containment across endpoint controls, by Aquila I’s description.
WAF and application defences
Tests the WAF and application defences against injection, scripting and request-manipulation techniques at the web layer.
Email and web gateways, DLP
Tests phishing detection, malware inspection and business email compromise controls, plus web gateway and DLP policy.
Do alerts fire and escalate?
Checks whether alerts trigger, escalation paths work and response workflows run, so the SOC is tested as well as the tools.
Fixes ranked by exploitability
Scores simulated attack success and coverage gaps, so the fix list is ranked by what an attacker could actually get through.
Baselines and executive reports
Tracks exposure scores, detection accuracy and validation results against a baseline over time, with executive-ready dashboards.
Watch Aquila I BAS in action
Aquila I’s three-minute BAS video from March 2023, made when the product sat inside its Threat Management Platform. From Aquila I’s official channel.
Breach & Attack Simulation (BAS)
Three minutes from 2023, when BAS sat in Aquila I’s Threat Management Platform: attack cycles, lateral movement, exfiltration.
Want a live, India-context walkthrough for your environment?
Book a guided demo →Your controls passed on the day they went live. Aquila I BAS checks whether they still do.
Here’s what genuinely sets it apart — and exactly where it stops.
Tests the controls you already paid for
Most estates run an EDR, a WAF, a firewall, an email gateway and DLP, each configured once and trusted ever since. Aquila I BAS replays attacker techniques against all of them and shows which ones detect, which block and which stay silent, so configuration drift is found by a test rather than by an incident.
Chains, not single techniques
A control can pass every isolated test and still let a sequence through. Aquila I models multi-stage chains, from initial access to privilege escalation, lateral movement and exfiltration, mapped to MITRE ATT&CK, and scores each run by how far the simulated attacker got rather than by a pass-or-fail tally.
Tests the SOC as well as the tools
Aquila I says BAS checks whether alerts trigger, escalations reach the right people and response workflows run. Inside its own platform, results become a detection benchmark in the Security Data Lakehouse, which matters most if you also run Aquila I AI SOC; on another SIEM, ask how results reach it.
Where it stops
It validates controls against known techniques; it does not hunt for unknown exposures the way CART does, and it is not a human red team or a CERT-In-empanelled audit. Pricing is quote-only, the hosting region and agent footprint are not published, the scenario count is not stated, and Aquila I names no BAS customers.
The numbers behind the platform
What your Aquila I BAS rollout looks like
List the controls in scope
Name every EDR, WAF, firewall, email and web gateway and DLP policy to test, who owns each, and which ones an auditor checks.
Settle hosting and footprint
Get Aquila I’s hosting region and the agents or simulators it needs in writing, then record both in your DPDP and risk registers.
Run a first baseline
Run the attack chains against a pilot segment, with the SOC told the window, and record what was detected and what was blocked.
Fix and re-test
Work the ranked fix list with each control owner, then re-run the same chains to prove the gaps closed and nothing else broke.
Set the cadence
Agree how often chains run, who reads the exposure trend, and whether CART or AI SOC belong in the same contract.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“The first run showed our EDR logging two lateral-movement steps but blocking neither. That alone justified the pilot.”
“Our email gateway passed the phishing tests but missed a malware-inspection case after a policy change last quarter.”
“We show the ATT&CK view at the audit committee; results mapped to tactics are easier to explain than a CVE count.”
“Running the ransomware chain monthly caught a DLP rule that had quietly been disabled during a firewall migration.”
“Useful, but we asked three times where results are hosted. Get the region in writing before your security review.”
“A young product with thin connector docs; feeding results into our existing SIEM took longer than the sales call said.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and review-site grids score satisfaction, not fit for your estate. So here’s TechBag’s synthesis of the breach and attack simulation market — tap any vendor to see why it sits where it does.
TechBag Breach and Attack Simulation Grid
Execution strength vs product vision — the classic market map, minus the paywall.
Quote-only; young Indian vendor, no named customers.
Deployment Choice × Validation Depth
The grid nobody publishes — how many ways a product can be deployed in your estate vs how deep its validation goes: attack library, detection checks and mitigation content.
SaaS; seven control types; scenario count and agents not documented.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
Aquila I BAS vs the validation field
Against Picus Security Validation Platform, Cymulate Exposure Validation, SafeBreach Validate, AttackIQ and Pentera — on deployment, attack library, controls, detection, mitigation, price, India data and exit.
| Dimension | Aquila I Adversarial Exposure Validation (BAS) | Picus Security Validation Platform | Cymulate Exposure Validation | SafeBreach Validate | AttackIQ (Flex, Enterprise) | Pentera |
|---|---|---|---|---|---|---|
| What it is | ATT&CK control testing | Validation platform | Exposure validation | BAS with Propagate | Self-serve to managed | Automated pentesting |
| Deployment | SaaS; footprint unclear | SaaS, on-prem, air-gap | SaaS on AWS + agents | Simulators everywhere | Agentless Flex or full | Agentless, by its account |
| Attack library | Not quantified | Threat-led library | Library plus custom | Hacker’s Playbook | ATT&CK-native | Exploits, not a library |
| Controls covered | Seven control types | EDR, SIEM, NGFW, WAF | Across the stack | Network, host, cloud | NGFW, EDR, segmentation | Paths, not rules |
| Detection validation | Alerts and escalations | Detection Rule Validation | Detection Studio | Via integrations | Detection outcomes | Second to exploitation |
| Mitigation guidance | Ranked fixes | Vendor-specific rules | Auto Mitigation | Points to the gap | Threat Debt Index | Pentera Resolve |
| Platform scope | Part of a wider platform | BAS, pentest, exposure | CTEM suite | Validate + Propagate | Validation-focused | Core, Surface, Cloud |
| Pricing model | Quote only | Yearly, per product | Quote only | Quote only | Free, credits, monthly | Quote only |
| Published entry price | Not published | Not published | Not published | Not published | $0 / $300 / $4,995 | Not published |
| India data region | Not published | On-prem keeps it local | Not documented | Not documented | Not documented | Not documented |
| Customer proof | None published | Reviews and rankings | Peer-review ratings | Fortune 500 claim | Large free user base | Ask for references |
| Lock-in and exit | Results in its lakehouse | Agent removal, export | Agents and history | Simulators to retire | Flex: nothing to remove | Agentless exit |
| Regulator-ready report | Not a VAPT report | Frameworks, not VAPT | Frameworks, not VAPT | Evidence, not VAPT | NIST, DORA, ISO maps | Pentest-style evidence |
| Best fit | Indian buyer, one vendor | Mature SOC, many controls | Validate and auto-fix | Large, distributed estates | Try before you commit | Prove what is exploitable |
Which approach fits you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose Aquila I Adversarial Exposure Validation (BAS) if…
- ✓You want to know whether your EDR, WAF, firewall, gateways and DLP still stop known ATT&CK techniques, tested on a schedule
- ✓You prefer an Indian vendor and may also buy its CART, attack surface monitoring or AI SOC products
- ✓Your team will act on a ranked fix list and wants SOC alerting and escalation tested in the same run
Compare alternatives if…
- ✓You need a price before a sales call — AttackIQ Flex publishes a free tier, credit packs and a monthly rate
- ✓Simulation data must stay on your own site — Picus offers on-premises and air-gapped deployment
- ✓You want proof of real exploitation rather than simulation — Pentera runs safe exploits in production
Do not expect…
- ✓A report a regulator accepts in place of a VAPT: it is not a CERT-In-empanelled audit or a human red team
- ✓A published price, a published hosting region or named BAS customers
- ✓Discovery of unknown internet-facing assets — that is the job of attack surface monitoring and CART
TechBag has no breach and attack simulation guide yet, so Aquila I Adversarial Exposure Validation (BAS) sits outside the category guides. Browse all products to compare it with the rest of the catalogue. →
What does checking your controls by hand cost you?
Drag the sliders (endpoints in scope; engineer-hour cost). Estimates model the engineering time spent re-checking EDR, firewall, gateway and DLP behaviour by hand after changes and chasing drift found during incidents, at an assumed 1.5 hours per endpoint a year, with 70% of it removed by scheduled simulation and ranked fixes. Both figures are assumptions. Illustrative.
Loaded cost = salary + overheads per productive hour. Illustrative only — your TechBag quote models your actual environment and modules.
Three ways to consume it
Quote only. Aquila I publishes no price for BAS or any other product, no INR list and no licence meter, so it is not clear whether a quote counts endpoints, scenarios, assessments or a platform fee. The agents or simulators it needs are not documented either, and they affect the cost of running it. TechBag lists the controls in scope first, then gets the quote itemised in INR with GST.
Aquila I BAS
Best for testing the controls you already own
- Quoted per estate; no public meter
- ATT&CK-mapped multi-stage chains
- EDR, WAF, firewall, gateways, DLP
+ Platform add-ons
Best for a broader rollout
- Scoped to your estate
- Add-on modules as needed
- Phased, right-sized deployment
Aquila I BAS with CART
Best for testing controls and exposures together
- Two products, each quoted
- Inside-out plus outside-in validation
- Both feed the same lakehouse
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 8 questions to ask every vendor
Take this into your next vendor call — including ours.
What must be installed to run simulations — agents, virtual appliances or nothing — and on how many endpoints and segments?
Where does Aquila I host the SaaS and store simulation results? Get the region in writing for your DPDP Act records.
How many ATT&CK techniques and attack chains ship today, and how quickly are new threat campaigns added to them?
What stops a simulation from disrupting production — scoping, a kill switch, safe payloads — and who approves each run?
Which SIEMs and EDRs can it read results from? Is a connector list published, or is each one custom work?
What does the quote count — endpoints, scenarios, assessments or a platform fee — for what term, shown in INR with GST?
Can Aquila I arrange a reference call with a BAS customer in your sector, since it publishes no named case studies?
Will the BAS report satisfy your auditor, or do RBI, SEBI or IRDAI rules still require a separate empanelled VAPT?
Questions buyers ask
Ready to evaluate Aquila I BAS?
List the controls you want tested first, or let a TechBag advisor get Aquila I’s hosting region and agent footprint in writing and the quote itemised in INR.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.