A Safe Outcome Can Hide a Failed Security Control

I kept coming back to a small problem in security testing: If the business outcome is safe, do we know that the control under test actually worked? Often, we do not. A downstream safeguard may prevent...