Dorothy vs NetSPI Detective Controls Testing: Side-by-Side Comparison (2026)

Dorothy: Dorothy is a tool to test monitoring and detection capabilities for Okta environments, with modules mapped to MITRE ATT&CK® tactics..

NetSPI Detective Controls Testing: Validates detective security controls through attack simulations and testing. built by NetSPI. Core capabilities include MITRE ATT&CK-based attack simulations across the cyber kill chain, Linux environment attack simulations including remote code execution and data extraction, Azure Cloud attack testing for authenticated and anonymous scenarios..

Both serve the Threat Simulation market but differ in approach, feature depth, and target audience.

Dorothy is open-source with 191 GitHub stars. NetSPI Detective Controls Testing is developed by NetSPI. Vendor maturity, funding stage, and team size can be important factors when evaluating long-term viability and support quality.

Dorothy and NetSPI Detective Controls Testing serve similar Threat Simulation use cases: both are Threat Simulation tools, both cover Detection Rules, MITRE Attack. Key differences: Dorothy is Free while NetSPI Detective Controls Testing is Commercial, Dorothy is open-source. Review the feature comparison above to determine which fits your requirements.