Security validation

A tooling category that tests whether an exposure is genuinely exploitable and whether prevention and detection controls block or notice an attack, using evidence from the defender's own environment.