CBEST's defining characteristic is that it is intelligence-led: real, sector-relevant cyber threat intelligence is gathered about plausible threat actors targeting the firm, and that intelligence is used to build realistic attack scenarios executed against live production systems supporting the firm's most Important Business Services.
This distinguishes it sharply from a vulnerability scan (C), which is automated and non-contextual, from a compliance audit (D), which checks controls against a standard rather than testing real-world attacker tradecraft, and from a tabletop-only exercise (A), which involves no hands-on-keyboard technical activity.
CBEST deliberately tests people, process and technology together, including detection and response capability, not merely the presence of technical vulnerabilities.