Scenario-based testing is an evaluation method that checks how a system behaves across realistic, chained actions instead of a single input. In cyber security, it is often used to test AI agents, automation scripts, or security controls in a sandbox by simulating sequences such as reconnaissance, tool use, failure, retry, and recovery. The goal is to see whether the system stays safe when it must maintain state and adapt over multiple steps.
This matters because real attacks are usually campaigns, not one-off prompts. An attacker may switch tools, repeat probing, or rebuild an approach after a block. Scenario-based testing helps defenders find weaknesses that prompt-only checks miss, including unsafe tool access, poor approval flows, weak logging, and failures in least-privilege enforcement. It is especially useful for agentic systems that can act over time, because the risk emerges from the whole chain of behavior, not one isolated action.