# Adversarial control testing

URL: /systems/trust-and-governance/controls/adversarial-testing · Id: `control:adversarial-testing`

> A control tester attacks every preventive control daily in test, and each attempt is recorded as a refused Action.

A control tester attacks every preventive control daily in test, and each attempt is recorded as a refused [Action](/business/nouns/action).

## Satisfies
| Criterion | Text |
| --- | --- |
| [SOC2 CC4.1](/systems/trust-and-governance/criteria/soc2/cc4-1) | The entity performs ongoing or separate evaluations to confirm that the components of internal control are present and functioning. |
| [ISO27001 A.5.35](/systems/trust-and-governance/criteria/iso27001/a-5-35) | The approach to information security is reviewed independently at set intervals and after significant changes. |

## Implemented by
- [Verification](/code/verification)
- [Nightly quality run](/code/verification/nightly-quality-run)
- [Compliance](/systems/compliance)

## Test
| Step | Rule |
| --- | --- |
| Kind | Detective: it finds the failure after it happens. |
| Select | Every preventive control, in each report period. |
| Assert | Each has an unchanged Guard Version, zero bypass Events, and at least one `refused` test attempt. |

## Owner
[Tester](/agents/quality/tester), [Quality Team](/agents/quality).

## Example
Each day the tester tries to send a refund over the [Billing Specialist](/agents/finance/billing-specialist)'s $100 [Limit](/business/nouns/limit) in test. The attempt ends `refused`, the [Guard](/business/nouns/guard) [Version](/business/nouns/version) is unchanged, and the refused Action counts as that day's evidence.