Breach and Attack Simulation and penetration testing are both approaches to security validation. Penetration testing, which is most commonly performed by human ethical hackers, is focused on discovering and exploiting vulnerabilities in systems, networks and applications. BAS, on the other hand, is fully automated and used to simulate specific threats such as ransomware and test the effectiveness of security controls against them.