There's 2 reasons why security researchers go beyond a theoretical demonstration into a destructive one: 1) Security researchers have an intense need to show t

There's 2 reasons why security researchers go beyond a theoretical demonstration into a destructive one: 1) Security researchers have an intense need to show their exploits actually work in case they're accused of not providing proof. If you go to Defcon, most of the presenters spend half their talk on showing use of the exploit, no matter how tedious it is to the audience. (When I supervise IT security audits, I have to tell pentesters just to document what they find instead of making changes, which introduces more problems and wastes time and effort. I've had auditors find a configuration file with passwords on a production server that uses them, then try to present a report on how they logged into each one. Duh, of course they work.) 2) This is related to #1, but business people, especially across silos in an organization, may not fully comprehend an exploit unless there is obvious proof. I've seen laughable levels of denial by otherwise intelligent people once they get into management. As in, "Yeah you showed it to me on the screen, but I'll need to confirm it with other sources" who then look at the same screen. Pro tip 1: by default AWS AMI's are not encrypted. (The reason is that the main list of AMIs doesn't use your KMS keys.) So if you have a compliance program that requires encryption at rest, get cracking! Pro tip 2: All theoretical exploits have shown to be practical ones later. Stop deceiving yourself.