Zero Security Theatre

Experiments

Each experiment runs in a real environment and produces a measured result. The limits beside it say what that result can prove.

Blast radius of one ordinary identity

What can be reached from a single compromised workstation account?

Take an ordinary user identity, not an administrative one.
Enumerate the reachable systems, data, and privilege escalation paths using attack-path analysis.
Attempt the shortest path to a crown-jewel system under agreed rules of engagement.
Repeat after remediation to confirm the path is closed rather than narrowed.

Limits
Bounded by the rules of engagement, which usually exclude the most disruptive techniques.

Could the organisation rotate every secret of one class quickly if it had to?

Select one class of secret, for example service account keys in a single environment.
Rotate all of them within a fixed window without a change freeze.
Record what broke, what was undocumented, and how long full restoration of function took.

Limits
One class in one environment. A full estate rotation is a different order of difficulty.