Red and blue teams working together so attacks are tested against defences in the open. Covers emulating attacker techniques mapped to MITRE ATT&CK, checking which detections fire, closing gaps in logging and rules, and repeating exercises after fixes.