Zero Security Theatre

Experiments

Each experiment runs in a real environment and produces a measured result. The limits beside it say what that result can prove.

End-to-end deletion verification

Does a deletion request remove the data everywhere the notice implies?

Seed a synthetic subject through the ordinary front door and let it propagate for a full reporting cycle.
Submit a deletion request through the published channel.
Search for the identifiers in primary stores, warehouses, logs, caches, ticketing systems, exports, backups, and vendor environments.
Record what remains, why, and whether it is consistent with the published notice.

Limits
Proves one property. It does not address access control, consent enforcement, or re-identification.

How many requirements can be answered by a machine today?

Take the current control set from the governing frameworks and contracts.
For each requirement, identify the system, query, and collection frequency that would answer it.
Classify each as automated, manual, or unmapped.

Limits
Measures evidence availability, not control effectiveness. A fully automated evidence set can still describe weak controls.

Does a withheld consent change what downstream systems do?

Create test records with consent withheld for each governed purpose.
Attempt every downstream use the consent governs, including analytics, export, vendor transfer, and secondary internal use.
Record each hop where the record still appears.

Limits
Tests the systems that are known. Undiscovered pipelines are the usual source of surprises.

When a control is quietly disabled, how long before anyone notices?

With change-management approval, disable or weaken a non-critical control in a controlled manner.
Measure the time until the change is detected and reported through ordinary monitoring.
Restore the control and record whether restoration itself was verified.

Limits
Ethically and operationally sensitive. It requires explicit authorisation and a tight blast radius.