The presentation will differentiate between classic security tests such as pentesting and red teaming and realistic breach-and-attack emulation. Specific examples will be used to show why only complete attack chains with real techniques and malware allow a reliable statement to be made about the effectiveness of security measures. Participants will learn how modern cyber defense can be tested in practice.