Zero Security Theatre

Experiments

Each experiment runs in a real environment and produces a measured result. The limits beside it say what that result can prove.

Map every requirement to an operational data source

How many requirements can be answered by a machine today?

Take the current control set from the governing frameworks and contracts.
For each requirement, identify the system, query, and collection frequency that would answer it.
Classify each as automated, manual, or unmapped.

Limits
Measures evidence availability, not control effectiveness. A fully automated evidence set can still describe weak controls.

When a control is quietly disabled, how long before anyone notices?

With change-management approval, disable or weaken a non-critical control in a controlled manner.
Measure the time until the change is detected and reported through ordinary monitoring.
Restore the control and record whether restoration itself was verified.

Limits
Ethically and operationally sensitive. It requires explicit authorisation and a tight blast radius.