Zero Security Theatre

Experiments

Each experiment runs in a real environment and produces a measured result. The limits beside it say what that result can prove.

Timed restore into a clean environment

What is the demonstrated recovery time and data loss for a critical system?

Choose a system the business considers critical and assume the production environment is compromised.
Rebuild a trusted environment, restore from an isolated copy, and bring the service to a usable state.
Have the business owner validate the restored state rather than the infrastructure team.
Record elapsed time, data loss against the last known good state, and every dependency that blocked progress.

Limits
One system under planned conditions. A real event involves several systems, missing staff, and competing priorities.

What does the provider actually do when called at three in the morning?

Agree the drill with the vendor relationship owner but not with the responding team.
Raise a realistic scenario through the contracted out-of-hours path.
Record who answered, how long it took, what they were permitted to do, and what waited on your approval.
Repeat at least annually and after any contract or platform change.

Limits
A cooperative drill. A real event may coincide with incidents at their other clients.

Could the organisation rotate every secret of one class quickly if it had to?

Select one class of secret, for example service account keys in a single environment.
Rotate all of them within a fixed window without a change freeze.
Record what broke, what was undocumented, and how long full restoration of function took.

Limits
One class in one environment. A full estate rotation is a different order of difficulty.