Zero Security Theatre

Most security, privacy, and compliance programs are described by what they have: tools, signed policies, completed training, closed findings, and certificates. That list does not tell anyone what would happen if a capable attacker tried something this afternoon.

Zero Security Theatre asks people to test the control and see what happens. How long did detection take? Did containment stop the spread? Did the restore work? Could a machine gather the proof without someone building a report by hand?

Compliance, training, and tools all have a job to do. Their presence alone does not prove that the job got done.

How can we tell whether security, privacy, and compliance work changes what happens during an attack?

Fourteen secondary questions run underneath it. What would actually happen if the attacker tried this today? Can we prove data is handled the way our documents claim? What evidence shows this requirement is working right now, rather than on the audit date? Which measurements predict survival? Which defensive work should machines carry? Which controls can be designed so that remembering is not required? How quickly could we return to validated operation after a destructive event? What does the vendor actually do at three in the morning? Which governance work can become engineering? What is the blast radius of one ordinary identity? How long does a quietly disabled control survive unnoticed? What is the demonstrated recovery time, not the target? Which unknowns are we currently reporting as acceptable? And what would change if we removed this control entirely?

Every section is marked as an observation, a hypothesis, evidence, an inference, a recommendation, or an unknown. The label tells the reader how much weight the claim can bear.

Unknown is red. Until a control has been tested, the organisation cannot say it works. Evidence that cuts against a claim stays in the library, and each pillar says what would prove it wrong.