I’m not sure I am following completely. Do you mean in the sense that you have a security hypothesis (e.g your service detects abnormal egress bandwidth use) an

I’m not sure I am following completely. Do you mean in the sense that you have a security hypothesis (e.g your service detects abnormal egress bandwidth use) and then you test and validate your assumptions? I don’t see why not.