When do you choose atomic single-technique tests over one full-chain emulation campaign?

## The two shapes **Atomic test.** One technique, executed on its own, with a defined precondition, a defined observable and a defined success criterion. It is small enough to run repeatedly, to script, and to diff against last quarter's result. **Full-chain campaign.** A sequence of techniques in the order and roughly the tempo a real intrusion would follow - initial access, then whatever the profile says comes next, through to the objective. It is one continuous story rather than a set of independent experiments. Both are legitimate; they answer different questions, and choosing between them is a selection decision made before anything runs. ## What each can honestly claim An atomic result supports a narrow, strong statement: *this behaviour, implemented this way, on this date, produced this telemetry, and this rule fired or did not*. Because nothing else was happening, the result is attributable - a failure is localisable to a missing log source, a missing rule, or an unworked alert. A chain result supports a broad, weaker statement: *this sequence, run this once, was or was not turned into a verdict within this time*. It is weaker because it is a single sample under one set of conditions, and because a result at stage five is entangled with everything that happened at stages one to four. It is broader because it is the only shape that exercises the things that only exist between stages: correlation across data sources, an analyst deciding that two mediocre signals together are worth escalating, a hand-off between shifts while the activity is still live. ## The confound that catches people out If a six-stage chain is contained at stage two, stages three to six did not run under realistic conditions. Teams routinely report the whole chain as "tested" because it was planned, which is a fabrication. There are two defensible options, and both must be stated in the report: - **Stop.** The exercise answered its question - the intrusion was caught early - and the later stages remain unmeasured. - **Continue by prior agreement.** The operator resumes from an assumed position after the defenders have been told, and every result from that point is labelled as executed under artificial conditions, because a real adversary would already have lost access. What you cannot do is average the two and present one coverage claim. ## Cost, repeatability and trending Atomic tests are cheap enough to run many of, which means you can cover breadth, cover several **variants** of the same behaviour, and re-run them after a rule change to check for regressions. That repeatability is what makes them trendable: a number that moves for a comprehensible reason. A chain is expensive, disruptive and hard to repeat identically, so its output is a narrative finding rather than a metric. Trending single chain runs across quarters is close to meaningless, because the conditions differ every time - different staffing, different noise, different estate. ## An illustration Suppose the profile describes an identity-and-SaaS route: consent phishing, a token granted to an application, then paced collection out of mailboxes. - **As atomics**: one test grants a consent and checks whether the identity provider's grant audit record is collected and alerted; a second uses a token to read a seeded mailbox and checks whether the tenant's audit trail shows it. You learn precisely which of the two surfaces you can see. - **As a chain**: the consent happens, days pass, the collection starts slowly, and you learn whether anybody joined the grant to the later reads and called it an intrusion. If nobody did, you learn something the atomics cannot tell you - both signals may have existed and still not have been assembled into a verdict. Notice that the atomic version can pass on both tests while the chain still fails. That gap is the reason mature programmes run both. ## How to decide Ask what claim you owe the sponsor. | The question asked | The shape that answers it | | --- | --- | | Which of these behaviours produce evidence we can see? | Atomic | | Did a rule change break detections that used to work? | Atomic, re-run | | How narrow is our detection for this behaviour? | Atomic variants | | Would this crew's sequence be turned into a verdict? | Chain | | Does correlation and hand-off work while activity is live? | Chain | A common and defensible plan is atomics first to establish per-technique visibility, fixes applied, then a chain to test whether the loop assembles those signals into a decision. The reverse order is defensible too when the sponsor's question is genuinely end-to-end and nobody wants a diagnosis yet.