Zero Security Theatre

Experiments

Each experiment runs in a real environment and produces a measured result. The limits beside it say what that result can prove.

Measure the real detection interval

How long does it take to notice activity that a deployed control claims to detect?

Select techniques the current tooling explicitly claims to cover.
Execute them safely in production, with the security team unaware of the timing.
Record the interval from execution to first accurate alert, and to first human action.
Repeat quarterly with varied techniques and record the distribution rather than the best case.

Limits
Establishes detection capability for the tested techniques only. It says nothing about unknown techniques or about containment quality.

What can be reached from a single compromised workstation account?

Take an ordinary user identity, not an administrative one.
Enumerate the reachable systems, data, and privilege escalation paths using attack-path analysis.
Attempt the shortest path to a crown-jewel system under agreed rules of engagement.
Repeat after remediation to confirm the path is closed rather than narrowed.

Limits
Bounded by the rules of engagement, which usually exclude the most disruptive techniques.