At the Adversary Village booth during RSA Conference 2025, I have run hands-on threat actor and ransomware scenarios built against the kind of controls companies actually run.
Participants followed an attack from initial access up to the point of encryption and had to respond at each stage. Some found that detections they trusted never fired. Others found the slow part of their response was the hand-offs between people, not the tooling. Everyone left with a short list of what to fix first.
