A subject deliberately performs a limited technical action to determine whether a security control, detection rule, workflow, or investigative process will identify, block, or escalate the behavior. The action may appear minor in isolation, but its purpose is to validate whether a later, more serious infringement can be conducted without detection or consequence. This behavior is distinct from the Motive ‘Boundary Testing’, which describes the subject’s motive for testing organizational tolerance. 'Testing Security Controls' is the preparatory action itself: the subject probes a specific technical or procedural control to assess whether the organization detects, prevents, or responds to the activity. Testing may involve sending a small file to a personal email account, uploading non-sensitive material to an unapproved cloud service, installing a minor unauthorized tool, accessing a restricted repository, printing a low-value document, using an unapproved browser extension, or attempting to bypass a proxy, DLP, CASB, EDR, or identity control. The subject may then wait to see whether they are contacted by security, management, HR, or another authority, or simply confirm whether the action succeeded. Successful testing may increase confidence, refine the subject’s method, or identify a viable path for later data exfiltration, unauthorized access, policy circumvention, sabotage, or another infringement. Investigative RelevanceTesting security controls is often visible through low-volume, low-impact actions that precede more serious activity. The key investigative feature is not the technical action alone, but the pattern of deliberate probing, success validation, delay, and later escalation.Investigators should assess whether the subject conducted a small-scale action before a larger attempt, repeated similar activity across different channels, or paused after the test to observe whether a response occurred. A delay between the test and later infringement may indicate that the subject was assessing organizational reaction time, alert handling, or enforcement consistency. Example Scenarios:A subject emails a harmless internal document to a personal account and waits several days before attempting to transfer sensitive files.A subject uploads a small non-sensitive file to an unapproved cloud storage platform to test whether DLP, proxy, or CASB controls block the upload.A subject accesses a repository outside their normal role scope and monitors whether an access review, manager notification, or security alert follows.A subject installs an unauthorized browser extension to determine whether browser or endpoint controls detect unapproved extension use.A subject compresses, renames, encrypts, or stages a small test file before applying the same method to sensitive data.

A subject identifies or assesses routes through which they or another person could enter, leave, or move through an organizational facility while reducing the likelihood of challenge or detection. The subject may observe loading areas, emergency exits, service corridors, shared tenant spaces, stairwells, parking access points, delivery entrances, maintenance routes, or locations with limited physical security coverage. They may also assess whether doors are routinely propped open, whether exit routes permit re-entry, or whether movement between zones can occur without an additional credential check. The behavior may indicate preparation to bypass normal entry controls, facilitate unauthorized third-party access, remove assets, or move between restricted areas without creating a complete access record.

A subject intentionally alters the filename, file extension, metadata tags, document properties, or visible descriptive attributes of sensitive organizational data to make it appear to be benign personal information. This may include disguising proprietary, regulated, technical, financial, customer, or strategic material as photographs, household records, recipes, receipts, travel documents, music files, temporary files, or other low-risk personal content. This technique is typically performed before data staging, transfer, or exfiltration. It may reduce scrutiny during manual review, mislead investigators during triage, or weaken controls that rely on filename, extension, path, metadata, or user-applied classification fields. Investigators should assess this behavior in proximity to file access, bulk download, archive creation, removable media use, cloud upload, email transmission, or other indicators of planned data loss. A common scenario occurs during offboarding, where a subject is permitted to remove or transfer legitimate personal files from a corporate device before returning the asset. The subject may exploit this authorized window by disguising sensitive organizational data as personal material, relying on the expectation that files labeled as photographs, tax records, household documents, or other personal content will receive less scrutiny. This behavior can create ambiguity for investigators because the initial transfer context may appear procedurally authorized, while the concealed content indicates preparation for later exfiltration or unauthorized retention. Examples of UseA subject renames 2026_Product_Roadmap.xlsx to holiday_budget.xlsx before copying it to removable media.A subject changes customer_export.csv to family_photos.tmp and stores it in a personal folder prior to upload.A subject modifies document properties, author fields, tags, or comments to remove project, client, or classification references.A subject applies misleading metadata such as “personal,” “recipe,” “tax,” “school,” or “photos” to files containing proprietary information.A subject changes an engineering design file extension to appear as a media, text, or backup file before moving it into a staged directory.