Testing Monitoring and Response Processes

A subject conducts a minor policy violation or suspicious action to determine whether the organization detects the behavior, how quickly it responds, and which personnel or processes become involved.

Unlike testing a particular technical control, the subject is assessing the organization’s wider investigative and enforcement response. They may perform an observable but low-impact action, wait to see whether they are contacted, and use the absence, timing, or nature of the response to estimate alert-review practices, escalation thresholds, investigative coverage, or Organizational Tolerance.

The subject may repeat similar tests through different systems or channels to establish whether detections are centrally correlated. They may also deliberately pause before escalating, allowing time to determine whether the test has produced a security, management, Human Resources, or compliance response.

Investigators should look for a sequence consisting of a minor test action, an observation period, and a later increase in severity or volume. Repeated low-level infringements without corrective intervention may provide the subject with confidence that more serious activity will also go undetected or unenforced.