Zero Security Theatre

Experiments

Each experiment runs in a real environment and produces a measured result. The limits beside it say what that result can prove.

Measure the real detection interval

How long does it take to notice activity that a deployed control claims to detect?

Select techniques the current tooling explicitly claims to cover.
Execute them safely in production, with the security team unaware of the timing.
Record the interval from execution to first accurate alert, and to first human action.
Repeat quarterly with varied techniques and record the distribution rather than the best case.

Limits
Establishes detection capability for the tested techniques only. It says nothing about unknown techniques or about containment quality.

What is the demonstrated recovery time and data loss for a critical system?

Choose a system the business considers critical and assume the production environment is compromised.
Rebuild a trusted environment, restore from an isolated copy, and bring the service to a usable state.
Have the business owner validate the restored state rather than the infrastructure team.
Record elapsed time, data loss against the last known good state, and every dependency that blocked progress.

Limits
One system under planned conditions. A real event involves several systems, missing staff, and competing priorities.

When a control is quietly disabled, how long before anyone notices?

With change-management approval, disable or weaken a non-critical control in a controlled manner.
Measure the time until the change is detected and reported through ordinary monitoring.
Restore the control and record whether restoration itself was verified.

Limits
Ethically and operationally sensitive. It requires explicit authorisation and a tight blast radius.