diff --git a/malsim/mal_simulator/defense_surface.py b/malsim/mal_simulator/defense_surface.py
index 111326b6..f1365c87 100644
--- a/malsim/mal_simulator/defense_surface.py
+++ b/malsim/mal_simulator/defense_surface.py
@@ -15,7 +15,7 @@ def get_defense_surface(
     agent_actionability_rule: NodePropertyRule[bool] | None,
 ) -> Set[AttackGraphNode]:
     """Get the defense surface.
-    All non-suppressed defense steps that are not already enabled.
+    All defense steps that are not already enabled.
 
     Arguments:
     graph       - the attack graph
@@ -27,5 +27,4 @@ def get_defense_surface(
         if node_is_actionable(agent_actionability_rule, node)
         and not node_is_blocked(sim_state, node)
         and node not in sim_state.enabled_defenses
-        and 'suppress' not in node.tags
     }
diff --git a/tests/test_mal_simulator.py b/tests/test_mal_simulator.py
index 30c8dbbe..101b9c61 100644
--- a/tests/test_mal_simulator.py
+++ b/tests/test_mal_simulator.py
@@ -837,9 +837,18 @@ def test_defender_step_rewards_one_off(
     assert sim.agent_reward(defender_state) == -rewards[access_network_and_conn]
 
 
-# TODO: Some of the assert values in this test have changed when updating the
-# attacker logic. We should check to see if the behaviour is the new behaviour
-# is correct.
+def defender_supressed_actionability(
+    lang_graph: LanguageGraph,
+) -> dict[str, dict[str, bool]]:
+    by_asset_type: dict[str, dict[str, bool]] = {}
+    for asset_type in lang_graph.assets.values():
+        by_asset_type[asset_type.name] = {}
+        for step in asset_type.attack_steps.values():
+            if step.type == 'defense':
+                by_asset_type[asset_type.name][step.name] = 'suppress' not in step.tags
+    return by_asset_type
+
+
 def test_agent_state_views_simple(
     corelang_lang_graph: LanguageGraph, model: Model
 ) -> None:
@@ -849,13 +858,18 @@ def test_agent_state_views_simple(
     mss = MalSimulatorSettings(seed=13, ttc_mode=TTCMode.PER_STEP_SAMPLE)
     attacker_name = 'attacker'
     defender_name = 'defender'
+    defender_actionability = NodePropertyRule(
+        by_asset_type=defender_supressed_actionability(corelang_lang_graph)
+    )
     # Create simulator and register agents
     sim = MalSimulator(
         attack_graph,
         sim_settings=mss,
         agents=(
             AttackerSettings(name=attacker_name, entry_points=frozenset({entry_point})),
-            DefenderSettings(name=defender_name),
+            DefenderSettings(
+                name=defender_name, actionable_steps=defender_actionability
+            ),
         ),
     )
 
diff --git a/tests/testdata/scenarios/bfs_vs_bfs_network_app_data_scenario.yml b/tests/testdata/scenarios/bfs_vs_bfs_network_app_data_scenario.yml
index dbd377df..3c43c212 100644
--- a/tests/testdata/scenarios/bfs_vs_bfs_network_app_data_scenario.yml
+++ b/tests/testdata/scenarios/bfs_vs_bfs_network_app_data_scenario.yml
@@ -24,3 +24,50 @@ agents:
       by_asset_name:
         Linux system:
           notPresent: 50
+    actionable_steps:
+      by_asset_type:
+        'Application':
+          - 'notPresent'
+          - 'supplyChainAuditing'
+        'ConnectionRule':
+          - 'payloadInspection'
+          - 'restricted'
+        'Credentials':
+          - 'notDisclosed'
+          - 'notGuessable'
+          - 'notPhishable'
+          - 'unique'
+        'Data':
+          - 'notPresent'
+        'Group':
+          - 'notPresent'
+        'Hardware':
+          - 'hardwareModificationsProtection'
+          - 'supplyChainAuditing'
+        'HardwareVulnerability':
+          - 'notPresent'
+        'IAMObject':
+          - 'notPresent'
+        'IDPS':
+          - 'effectiveness'
+          - 'notPresent'
+          - 'supplyChainAuditing'
+        'Identity':
+          - 'notPresent'
+        'Network':
+          - 'adversaryInTheMiddleDefense'
+          - 'eavesdropDefense'
+          - 'networkAccessControl'
+        'Privileges':
+          - 'notPresent'
+        'RoutingFirewall':
+          - 'notPresent'
+          - 'supplyChainAuditing'
+        'SoftwareVulnerability':
+          - 'notPresent'
+        'User':
+          - 'noPasswordReuse'
+          - 'noRemovableMediaUsage'
+          - 'securityAwareness'
+        'Vulnerability':
+          - 'notPresent'