Many organisations make use of offensive security exercises to test their security posture - including Google. As part of testing of Google’s Detection and Response capability, engineers undertake a variation of this testing, mimicking the behavior and techniques of real-world, highly sophisticated adversaries. This talk discusses Google’s approach to these exercises, why they’re important, and how other organisations can benefit from this approach.