Relentless Adversary Research Powering Threat-Informed Defense

The AttackIQ Adversary Research Team (ART) transforms threat intelligence into operational testing—delivering rapid guidance and production-ready emulations to help security teams stay ahead of emerging threats.

Accelerated Threat Response

When threats emerge, speed is critical. ART rapidly translates evolving intelligence into actionable emulations, helping defenders validate exposures before attackers exploit them.

24-Hour Initial Response

First assessments released within 24 hours of CISA or US-CERT alerts

72-Hour Emulation Package

Complete attack graph aligned to MITRE ATT&CK, ready for deployment

Flex Delivery

Research-driven scenarios integrated into the AttackIQ platform for safe, scalable testing

Quantitative Insights

Every emulation generates real performance data to guide detection tuning and risk reduction

Recognized Leadership

Founding Research Partner at MITRE’s Center for Threat-Informed Defense and contributor to national advisories

High-Fidelity Emulations Powered by Adversary Insight

ART doesn’t just analyze threats—they operationalize them. Every package is designed to safely test your defenses using up-to-date adversary behaviors.

Safe for Production: Designed for non-disruptive validation in live environments
MITRE ATT&CK-Aligned: Mapped to known tactics, techniques, and procedures
Intelligence-Led: Based on real-world campaigns, malware variants, and threat actor behavior
Data-Backed: Informed by AttackIQ Flex results to measure detection and prevention effectiveness
Enterprise-Ready: Validates defenses across cloud, hybrid, and on-prem environments
Longitudinal Tracking: Continuously measure security control performance over time, not just point-in-time testing
Executive Analytics: Generate real-time performance data to answer board-level questions like “ Are we ready for the next attack?” and support inquiries from senior leaders and regulatory bodies

Recognized by Defenders. Trusted by Leaders.

The AttackIQ Adversary Research Team is trusted across government and industry, shaping the cybersecurity conversation through threat-informed defense.

CISA

Contributor to national cybersecurity advisories and rapid-response alerts

MITRE’s Center for Threat-Informed Defense

Founding research partner, shaping adversary emulation standards

Leading Security Conferences

Featured at Black Hat, ATT&CKcon, SXSW, and more

Industry Standards Bodies

Supporting alignment with NIST and Zero Trust frameworks

Latest Threat Research from the ART Team

Check out the team’s latest work, including new attack graphs, threat insights, and emulation package releases.

Access Denied: A Behavioral Analysis of Modern Ransomware Operations

Discover how ransomware truly operates—from access to impact—and how defenders can detect patterns, validate controls, and improve resilience.

RomCom Threat Report

AttackIQ research exposes RomCom’s espionage-to-ransomware convergence and provides 7 emulations to harden detection and response.

Revisiting the Versatile Qilin Ransomware

AttackIQ has released an updated attack graph in response to emerging threat intelligence associated with the deployment of Qilin ransomware, a ransomware strain that first appeared in July 2022 and remains one of the most active ransomware families today. This update includes new behaviors related to the operators of the Qilin ransomware, which have been identified as recently as October 2025.

The Unsung Heroes Behind Your Cyber Readiness

Meet the cybersecurity experts who turn threat intelligence into real-world defense.

Paul Reid

VP, Adversary Research

Paul Reid is VP of Adversary Research at AttackIQ, leading a team focused on AI-driven and nation-state threats, threat-informed defense, and security control validation. With over two decades in cybersecurity, he has led threat hunting and intelligence functions protecting governments and critical infrastructure, authored Biometrics for Network Security, and holds multiple cybersecurity patents.

Andrew Costis

Engineering Manager, Adversary Research Team

Andrew Costis (“AC”) is the Engineering Manager of the Adversary Research Team at AttackIQ, with more than 24 years of tech and cybersecurity experience. Previously, he conducted security research and threat analysis with VMware Carbon Black’s Threat Analysis Unit (TAU) and LogRhythm Labs, specializing in malware reverse engineering, threat tracking, and the discovery of emerging campaigns.

Giovanni López

Principal Security Engineer

Giovanni researches and develops new security control testing content to help customers evaluate and strengthen their security defenses. Before focusing on security control testing, he gained diverse experience across the information security field—including roles as a penetration tester and reverse engineer.

Francis Guibernau

Senior Adversary Research Engineer

Francis conducts in-depth threat research and analysis to design and create highly sophisticated and realistic adversary emulations. He also coordinates the CTI project, which focuses on researching, analyzing, tracking, and documenting adversaries, malware families, and cybersecurity incidents.

Ayelen Torello

Adversary Research Engineer

Ayelen Torello creates adversary emulations to enable customers to test and validate their security controls. Ayelen has extensive experience in the CTI field and is a results-driven professional with a passion for malware analysis and conducting thorough investigations.

Gerardo Schrott

Adversary Research Engineer

Gerardo Schrott is an Adversary Research Engineer at AttackIQ, where he designs and develops adversary emulations to help customers test and validate their security controls.

Mack Hopkins

Adversary Research Engineer

Mack is a software developer and Adversary Research Engineer at AttackIQ, where he focuses on building adversary emulations. He creates realistic, testable threat scenarios mapped to MITRE ATT&CK.

Zach Taylor

Adversary Research Engineer

Zach graduated from Oregon State University in 2022, majoring in math, computer science, and cybersecurity. He began working for DeepSurface Security as a security engineer after graduation, before joining AttackIQ following the acquisition of DeepSurface in January of 2025.

Stay Ahead of the Adversary

Get real-time insights, ready-to-run attack simulations, and the expert guidance you need to validate your defenses against today’s most critical threats.

Never Settle for Uncertainty

Validate Your Defenses

Take the guesswork out of threat exposure management. Validate your defenses with real-world attack scenarios and focus on what matters most—managing your risk.