At BSides Tampa 2025, held at the University of South Florida, I have spoken about adversaries that do not respect borders, geographic or organisational, and how to emulate them well enough to expose real gaps.
Checkbox testing does not tell you much. I made the case for putting controls under the kind of sustained, boundary-crossing pressure a determined group would apply, so the weaknesses that matter show up in a test and not in an incident.
