pasta-attack-sim

Simulate exploit chains by scoring threats and vulnerabilities with the DREAD model.

12|1|Updated Feb 9, 2026

Search Tags:#threat modeling #security assessment #PASTA #attack simulation #exploit chain #DREAD score

Ready to run

npx skills add https://github.com/florianbuetow/claude-code --skill pasta-attack-sim

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: pasta-attack-sim
Source: https://github.com/florianbuetow/claude-code/tree/main/plugins/appsec/skills/pasta-attack-sim
Command: npx skills add https://github.com/florianbuetow/claude-code --skill pasta-attack-sim

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill automates the process of simulating realistic cyber attack scenarios by combining identified threats with vulnerabilities, allowing for a quantitative assessment of exploitability and impact.

Core Features & Use Cases

Attack Chain Modeling: Constructs multi-step exploit scenarios from entry point to objective.
Exploitability Scoring: Utilizes the DREAD model to score attack chains based on damage, reproducibility, exploitability, affected users, and discoverability.
Detection Gap Analysis: Assesses whether existing security controls would detect or prevent simulated attacks.
Use Case: A security team can use this Skill to simulate how an external attacker might exploit a known vulnerability to gain access to sensitive customer data, providing a clear understanding of the risk and potential impact.

Quick Start

Simulate attack chains for critical vulnerabilities with deep analysis of detection gaps.

Frequently Asked Questions about pasta-attack-sim

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I simulate realistic exploit chains from identified threats and vulnerabilities?▼

Attack chain modeling constructs multi-step exploit scenarios from entry point to objective. It combines identified threats with vulnerabilities to simulate realistic cyber attack scenarios, providing quantitative assessment of exploitability and impact.

What is the DREAD model used for in attack simulation?▼

The DREAD model scores attack chains based on damage, reproducibility, exploitability, affected users, and discoverability. It provides a quantitative assessment of exploitability and impact for simulated cyber attack scenarios.

How does PASTA threat modeling apply to attack simulation?▼

PASTA threat modeling applies to attack simulation specifically at Stage 6. It requires prior outputs including a threat catalog, vulnerability inventory, and business assets to simulate realistic exploit chains and assess detection gaps.

Do I need a vulnerability inventory before simulating attack chains?▼

Yes, simulating attack chains requires prior stages' outputs including a threat catalog, vulnerability inventory, and business assets. These inputs are necessary to construct realistic multi-step exploit scenarios and assess detection gaps.

Can I assess security control detection gaps using attack simulation?▼

Yes, attack simulation includes detection gap analysis to assess whether existing security controls would detect or prevent simulated attacks. This helps security teams understand the risk and potential impact of exploited vulnerabilities.

What is the best way to score exploitability for multi-step attack scenarios?▼

Scoring exploitability for multi-step attack scenarios is best done using the DREAD model. It evaluates damage, reproducibility, exploitability, affected users, and discoverability to quantify the risk of simulated exploit chains.