I kept coming back to a small problem in security testing:
If the business outcome is safe, do we know that the control under test actually worked?
Often, we do not.
A downstream safeguard may prevent the final impact after an earlier control has already failed. If a test checks only the last step, the whole path goes green and the failed control disappears from the result.
I built a deliberately plain example to make that ambiguity visible: a support export, an entitlement boundary, and a release guard.
