A computing device generates a simulated attack for testing a cybersecurity system. A user of a networked system of computers is selected. A user definition defines a normal network usage behavior of the selected user. A current simulation time is initialized. Netflow data is generated and written to an output file for the selected user based on a profile definition of the selected user until a user simulation is complete. The profile definition is selected based on the current simulation time. Attack netflow data is generated and written to the output file based on the selected attack until an attack simulation is complete. The written netflow data is sorted in time order. The sorted netflow data is streamed to a cybersecurity system to determine a response by the cybersecurity system to the streamed data.