Why CISOs Are Using Security Chaos Engineering to Test Resilience

Lucas and Luna dive into Security Chaos Engineering—a practice where enterprises deliberately inject failures into production environments to test defensive resilience. Lucas explains how Netflix pioneered Chaos Monkey but argues that real security chaos engineering goes deeper, using controlled experiments like network partition failures, TLS certificate expirations, and API throttling to uncover blind spots before attackers do. Luna brings up a case study from a major bank that simulated a ransomware encryption event on a non-critical replica to validate their incident response playbook—saving an estimated $3 million in potential downtime. The episode covers why traditional penetration testing and red team exercises miss the chaotic complexity of real attacks, and how tools like AWS Fault Injection Simulator and open-source Litmus are making chaos engineering accessible to mid-market teams. Lucas and Luna also discuss the cultural shift required: security teams must embrace failure as data, not blame. The episode ends with a forward-looking question about whether regulators will eventually mandate resilience testing as they do stress testing for financial institutions. #SecurityChaosEngineering #CISO #ChaosEngineering #ResilienceTesting #NetflixChaosMonkey #AWSFaultInjection #LitmusChaos #ProductionTesting #IncidentResponse #RansomwareSimulation #EnterpriseSecurity #CybersecurityTrends #DevSecOps #Business #Technology #FexingoBusiness #BusinessPodcast #CyberResilience Keep every episode free: buymeacoffee.com/fexingo