Zero Security Theatre

Experiments

Each experiment runs in a real environment and produces a measured result. The limits beside it say what that result can prove.

Out-of-hours vendor escalation drill

What does the provider actually do when called at three in the morning?

Method

  1. Agree the drill with the vendor relationship owner but not with the responding team.
  2. Raise a realistic scenario through the contracted out-of-hours path.
  3. Record who answered, how long it took, what they were permitted to do, and what waited on your approval.
  4. Repeat at least annually and after any contract or platform change.

What is measured

  • Time to human response
  • Time to first action
  • Actions requiring client approval

Limits
A cooperative drill. A real event may coincide with incidents at their other clients.

Under Vendor and supply-chain resilience