Chaos engineering became well known for testing system resilience — deliberately injecting failures to see if systems and teams respond as expected. The same underlying idea applies powerfully to security: deliberately testing whether your detection and response actually work, rather than assuming they do.
The core idea, applied to security
Traditional security testing (vulnerability scanning, penetration testing) asks "can an attacker get in?" Security chaos engineering asks a different question: "if an attacker already got in, would we actually notice, and would our response process actually work?" It assumes compromise and tests the response, rather than testing prevention.
Example exercises
- Deploy a benign file matching a known malware signature and confirm your endpoint detection tooling actually flags it, rather than assuming the tool is configured and working correctly.
- Simulate exfiltration-like traffic patterns and confirm network monitoring detects and alerts on it.
- Revoke a credential unexpectedly (in a controlled test environment) and observe whether dependent systems fail gracefully or cause a cascading outage — testing resilience to credential issues, not just malicious actors.
- Simulate a specific alert firing and time how long it takes for the on-call process to actually respond, end to end.
Why "assume it works" is a risky default
Detection tooling that was correctly configured at setup can silently stop working — a misconfigured alert threshold, a broken integration, an expired API key for the alerting pipeline itself. Without periodically testing that detection actually fires as expected, these gaps go unnoticed until an actual incident reveals them at the worst possible time.
Running these safely
Well-designed security chaos exercises use controlled, clearly benign simulations rather than genuinely risky actions, run with predefined boundaries and an ability to halt immediately if anything behaves unexpectedly. Start small and low-risk, and expand scope as confidence in the safety of the exercise process grows.
What good outcomes look like
The goal isn't a clean pass on every exercise — a chaos exercise that reveals a detection gap is exactly the value it's meant to provide, surfaced deliberately and safely rather than discovered during a real incident. Track findings and fixes from these exercises the same way you'd track any other identified vulnerability.