Experiments
A register of the security theatre research program: what it tests, the evidence it uses, and the patterns it has found.
Measure the real detection interval
How long does it take to notice activity that a deployed control claims to detect?
Method
- Select techniques the current tooling explicitly claims to cover.
- Execute them safely in production, with the security team unaware of the timing.
- Record the interval from execution to first accurate alert, and to first human action.
- Repeat quarterly with varied techniques and record the distribution rather than the best case.
What is measured
- Time to detect
- Time to accurate understanding
- Share of techniques producing no alert
Limits. Establishes detection capability for the tested techniques only. It says nothing about unknown techniques or about containment quality.
Under program The dangers of security theatre, Attack-and-recovery engineering
Timed restore into a clean environment
What is the demonstrated recovery time and data loss for a critical system?
Method
- Choose a system the business considers critical and assume the production environment is compromised.
- Rebuild a trusted environment, restore from an isolated copy, and bring the service to a usable state.
- Have the business owner validate the restored state rather than the infrastructure team.
- Record elapsed time, data loss against the last known good state, and every dependency that blocked progress.
What is measured
- Demonstrated RTO
- Demonstrated RPO
- Count of blocking dependencies discovered
Limits. One system under planned conditions. A real event involves several systems, missing staff, and competing priorities.
Under program Recovery as a first-class discipline, Attack-and-recovery engineering
End-to-end deletion verification
Does a deletion request remove the data everywhere the notice implies?
Method
- Seed a synthetic subject through the ordinary front door and let it propagate for a full reporting cycle.
- Submit a deletion request through the published channel.
- Search for the identifiers in primary stores, warehouses, logs, caches, ticketing systems, exports, backups, and vendor environments.
- Record what remains, why, and whether it is consistent with the published notice.
What is measured
- Stores with residual data
- Time to full propagation
- Undocumented destinations discovered
Limits. Proves one property. It does not address access control, consent enforcement, or re-identification.
Under program The dangers of data privacy theatre
Blast radius of one ordinary identity
What can be reached from a single compromised workstation account?
Method
- Take an ordinary user identity, not an administrative one.
- Enumerate the reachable systems, data, and privilege escalation paths using attack-path analysis.
- Attempt the shortest path to a crown-jewel system under agreed rules of engagement.
- Repeat after remediation to confirm the path is closed rather than narrowed.
What is measured
- Systems reachable
- Steps to crown jewels
- Paths still open after remediation
Limits. Bounded by the rules of engagement, which usually exclude the most disruptive techniques.
Under program The dangers of security theatre, Attack-and-recovery engineering
Out-of-hours vendor escalation drill
What does the provider actually do when called at three in the morning?
Method
- Agree the drill with the vendor relationship owner but not with the responding team.
- Raise a realistic scenario through the contracted out-of-hours path.
- Record who answered, how long it took, what they were permitted to do, and what waited on your approval.
- Repeat at least annually and after any contract or platform change.
What is measured
- Time to human response
- Time to first action
- Actions requiring client approval
Limits. A cooperative drill. A real event may coincide with incidents at their other clients.
Under program Vendor and supply-chain resilience
Bounded credential rotation
Could the organisation rotate every secret of one class quickly if it had to?
Method
- Select one class of secret, for example service account keys in a single environment.
- Rotate all of them within a fixed window without a change freeze.
- Record what broke, what was undocumented, and how long full restoration of function took.
What is measured
- Time to rotate the class
- Integrations broken
- Undocumented dependencies found
Limits. One class in one environment. A full estate rotation is a different order of difficulty.
Under program Recovery as a first-class discipline, Human error without human blame
Map every requirement to an operational data source
How many requirements can be answered by a machine today?
Method
- Take the current control set from the governing frameworks and contracts.
- For each requirement, identify the system, query, and collection frequency that would answer it.
- Classify each as automated, manual, or unmapped.
What is measured
- Share automated
- Share manual
- Share unmapped
Limits. Measures evidence availability, not control effectiveness. A fully automated evidence set can still describe weak controls.
Under program Compliant Insecurity, GRC engineering
Consent enforcement probe
Does a withheld consent change what downstream systems do?
Method
- Create test records with consent withheld for each governed purpose.
- Attempt every downstream use the consent governs, including analytics, export, vendor transfer, and secondary internal use.
- Record each hop where the record still appears.
What is measured
- Hops where enforcement holds
- Systems ignoring the flag
Limits. Tests the systems that are known. Undiscovered pipelines are the usual source of surprises.
Under program The dangers of data privacy theatre, GRC engineering
How long does drift survive?
When a control is quietly disabled, how long before anyone notices?
Method
- With change-management approval, disable or weaken a non-critical control in a controlled manner.
- Measure the time until the change is detected and reported through ordinary monitoring.
- Restore the control and record whether restoration itself was verified.
What is measured
- Time to drift detection
- Whether restoration was verified
Limits. Ethically and operationally sensitive. It requires explicit authorisation and a tight blast radius.
Under program Compliant Insecurity, GRC engineering
Back to Zero Security Theatre · Experiments · Evidence · Patterns