AutoTTP vs Dorothy: 2026 Comparison
AutoTTP is a free threat simulation tool. Dorothy is a free threat simulation tool. Compare features, ratings, integrations, and community reviews side by side to find the best threat simulation fit for your security stack.
CST VerdictBased on our analysis of available product data, here is our conclusion:
Red teams and penetration testers who need to run repeatable attack chains without rebuilding them by hand should start with AutoTTP. It integrates directly with Empire, Metasploit, and Cobalt Strike, so your existing payloads execute as automated sequences rather than one-off commands, cutting setup time for regression testing and adversary emulation. The tool is free and openly maintained on GitHub with 259 stars, lowering the barrier to adoption in resource-constrained security programs. Skip AutoTTP if you're looking for attack simulation with built-in reporting, compliance mapping, or a web UI; it's a command-line automation layer, not a platform.
Okta security teams with detection gaps in their SIEM or XDR will find Dorothy's value in its free, attack-path testing that mirrors actual threat behavior instead of generic scanning. The MITRE ATT&CK mapping ensures your detection rules are validated against tactics adversaries actually use, not checkbox compliance. Skip Dorothy if you need continuous monitoring or remediation automation; it's a point-in-time validation tool, not a runtime detection layer.
Data verified Apr 2026
