The Adversarial Governance Methodology
SGaaS is delivered through a defined Adversarial Governance Methodology. This chapter sets out its three instruments — the Red Team Review, the Risk Simulation Lab and the Pre-Mortem Diagnostic — and how institutionalised challenge is applied to strategy and major decisions before they are committed.
Three tools constitute the adversarial methodology at the core of SGaaS: the Red Team Protocol, the Risk Simulation Lab, and the Pre-Mortem Diagnostic. Each draws on an established intellectual tradition and adapts it for a specific purpose, the delivery of structured, continuous, board-level governance challenge. What distinguishes their application within SGaaS is their integration, their governance context, and their sustained deployment on a retained basis rather than as episodic exercises.
The methodology’s lineage runs through Karl Popper’s account of how reliable knowledge is produced. No theory, however well-supported, can be proven correct by accumulated confirming evidence; it can only be provisionally corroborated, held open to further testing. What separates rigorous knowledge from its alternatives is not the evidence that supports it but the disciplined search for evidence that would refute it. “The criterion of the scientific status of a theory,” Popper wrote, “is its falsifiability, or refutability, or testability.” [1] The three tools below are instruments of that discipline applied to governance. They challenge the assumption that a strategy is sound, that a governance framework is working, or that a board decision is correct. They seek the conditions under which each would fail. A governance function that only accumulates confirming evidence produces comfort. A governance function that systematically attempts refutation produces resilience.
An epistemological distinction matters here. Technical systems can be tested empirically. A penetration test either breaches a firewall or it does not. Strategic assumptions cannot be broken empirically before the fact. An M&A valuation, a market-entry thesis, or a technology investment case depends on judgements about a future that has not yet arrived. What can be tested is not the assumption itself but the quality of the evidence supporting it, in particular whether the proxies are weak or strong, whether the reasoning is motivated or disciplined, and whether the cognitive biases documented by Kahneman are operating on the decision. SGaaS applies Popperian falsification to governance not by claiming to break strategic futures but by systematically dismantling the evidentiary basis on which those futures rest. The service produces a structured, adversarial examination of the evidence, the reasoning, and the cognitive conditions under which a strategic decision was reached. Where technical testing delivers a binary verdict, strategic falsification delivers a calibrated assessment of evidentiary fragility. Both are adversarial. They are not the same kind of test, and this paper does not claim otherwise.
The Red Team Protocol
Intellectual Origin
Red teaming has its modern origins in military and intelligence practice. The U.S. Army established its Red Team Leader Program [2] at the University of Foreign Military and Cultural Studies, Fort Leavenworth, in 2004, following intelligence failures that contributed to the Iraq War. The programme trains officers in structured adversarial analysis, the discipline of rigorously challenging plans, policies, and assumptions by adopting the perspective of an adversary or sceptic. The methodology has since been adopted by the CIA, FBI, UK Ministry of Defence, and NATO.
Bryce Hoffman, the first civilian graduate of the programme, documented its corporate application in Red Teaming (2017) [3], demonstrating that the same techniques used to stress-test military operations can be applied to business strategy, organisational design, and governance architecture. Micah Zenko’s Red Team (2015) [4] provided further evidence across military, intelligence, and corporate contexts.
The regulatory environment has begun to codify the adversarial principle itself. DORA’s requirement for threat-led penetration testing of critical IT functions in financial services establishes that structured adversarial challenge is a governance-level expectation. The analogy is directional, not equivalential. DORA tests technical infrastructure empirically; SGaaS tests strategic and governance assumptions through the falsification of their evidentiary support. What regulators have recognised in the technical domain, that critical functions should be subjected to structured adversarial scrutiny, applies with equal force to the strategic domain, where the consequences of unchallenged assumptions are no less severe.
The board-advisory literature has travelled in the same direction. Brodeur et al. [5] identified “a board culture that promotes dialogue and constructive challenge” as a defining feature of effective risk oversight, and recommended that boards concentrate governance attention on the three to five “big bets” on which the organisation actually depends. The concept is not novel. What has been missing is the architecture to deliver it consistently. The Red Team Protocol operationalises constructive challenge as a permanent function rather than as an aspirational cultural trait, and focuses that challenge on the specific strategic assumptions the board has the least appetite to question.
The 2026 COSO review of practical ERM provides the empirical case for that architecture. From Guidance to Action [6] reports that only 20% of risk practitioners surveyed perceive high psychological safety in leadership discussions, and identifies the most damaging risks as those that are known internally but never voiced. COSO frames candour as a capability that leaders must deliberately practise, reinforce, and protect. The diagnosis is correct. The remedy is incomplete. Candour cannot be willed into existence by the same leaders whose authority creates the social cost of dissent, and culture-based interventions inherit the same chain-of-authority constraints that suppress challenge in the first place. The 80% of organisations operating below the COSO candour threshold are not failing through inattention; they are subject to the structural pressures any internal challenge function inherits. The Red Team Protocol externalises the challenge function rather than asking culture to bear the load. The principal sits outside the chain of authority being questioned. Dissent is not a personal act of professional courage. It is the principal’s contracted output.
Definition and Operation
The Red Team Protocol is a structured adversarial assessment of strategic plans, governance frameworks, and board decisions. The SGaaS principal, operating independently of management, systematically identifies the assumptions on which a decision, strategy, or governance architecture depends and then subjects their evidentiary basis to falsification, testing whether the proxies are weak, the reasoning motivated, or the supporting evidence thinner than the confidence it carries.
In practice, a Red Team Protocol engagement proceeds through a defined sequence, with the analytical burden carried by the SGaaS principal rather than the board.
Phase 1: Asynchronous analysis. The principal maps the decision architecture, capturing what has been decided, by whom, on what evidence, with what assumptions, and with what alternatives considered or dismissed. This mapping is conducted through document review, management interviews, observation of governance processes, and coordination with the second and third lines. The principal then constructs adversarial scenarios, the conditions under which the key assumptions fail, the evidence is incomplete, or the dismissed alternatives prove correct. The principal performs this analytical work asynchronously, alongside the organisation’s existing governance rhythm. The board does not conduct the red team exercise. The board receives its distilled, high-signal output.
Phase 2: Forced independent deliberation. Before the principal reveals the Challenge Memo, each director independently submits a structured pre-deliberation assessment, recording their confidence in the key assumptions underlying the decision, their view of the two or three most material risks, and the conditions under which they would change their position. The principal collects these assessments anonymously and aggregates the results. This step is not optional. It is the mechanism through which the Red Team Protocol operationalises Kahneman, Sibony, and Sunstein’s Mediating Assessments Protocol at board level. Independent, evidence-based judgement must precede group synthesis. Without it, the board becomes a passive consumer of the principal’s analysis, and the decision hygiene the methodology depends on collapses into exactly the consensus dynamics it was designed to prevent.
Phase 3: Adversarial disclosure and structured debate. The principal then presents the Challenge Memo alongside the aggregated pre-deliberation data, revealing where directors’ prior confidence aligns with the adversarial findings and where it diverges. The board debates the decision with three inputs that no conventional governance process provides, namely their own independently committed positions, a structured adversarial assessment of the evidentiary basis, and a map of the divergence between the two. The board retains the authority to decide. The Red Team Protocol ensures that the decision is made with adversarial intelligence, cognitive self-awareness, and structured debate.
The forced deliberation step addresses a specific vulnerability in the original design. If the principal simply presents a completed Challenge Memo, the board’s role is reactive, limited to reading, discussing, and deciding. The pre-deliberation assessment reverses this. Directors commit their own positions before seeing the adversarial analysis, which means they engage cognitively with the assumptions rather than deferring to the principal’s conclusions. The resulting debate is a genuine contest between the board’s prior judgement and the adversarial evidence, not a presentation followed by questions.
Absence of institutionalised challenge Primary defect addressed: Absence of institutionalised challenge. The Red Team Protocol creates a permanent function whose explicit mandate is to challenge the assumptions underlying governance decisions. It does not replace the board’s judgement. It ensures that judgement is exercised against the widest possible range of adversarial intelligence.
The Risk Simulation Lab
Intellectual Origin
Scenario planning as a structured discipline emerged at Royal Dutch Shell in the 1970s, where Pierre Wack and his team developed a methodology for exploring alternative futures that enabled Shell to anticipate the 1973 oil crisis and respond more effectively than competitors who relied on single-point forecasts. Peter Schwartz, a former head of Shell’s scenario planning group, subsequently documented and extended the methodology in The Art of the Long View (1991), establishing scenario planning as a recognised tool for strategic decision-making under uncertainty.
The Risk Simulation Lab extends this tradition from strategic planning into governance. Where traditional scenario planning asks “what might happen?”, the Risk Simulation Lab asks “how would our governance respond?” It shifts the unit of analysis from the external environment to the organisation’s own decision-making architecture.
Definition and Operation
The Risk Simulation Lab is a scenario-based stress test of governance and leadership behaviour under crisis conditions. The SGaaS principal designs and facilitates simulated crises that are calibrated to the organisation’s specific risk profile, governance architecture, and strategic context.
The design draws on Taleb’s analysis of narrative fallacy [7], the human tendency to construct coherent stories from incomplete evidence. The simulations deliberately violate the organisation’s preferred narratives, presenting scenarios in which the growth strategy fails, the key assumption proves to be wrong, the regulatory environment shifts, or the reputational crisis arrives from an unexpected direction. By forcing participants to navigate conditions that challenge their mental models, the Lab reveals the assumptions on which governance depends. These assumptions are invisible under normal operating conditions.
In practice, a Risk Simulation Lab engagement is a facilitated exercise involving board members, senior management, or both, depending on the scenario’s scope. The principal constructs the scenario, manages its evolution in real time (depending on the scenario), and observes the governance response, noting who takes charge, what information is sought, what assumptions are tested or accepted, how dissent is handled, and where the decision-making architecture breaks down.
The output is observed evidence of how the organisation’s governance actually functions under adversarial conditions, evidence unavailable from any other source. Risk registers describe risks. The Risk Simulation Lab reveals how the organisation would actually respond to them.
Tetlock and Gardner’s research [8] on expert judgement reinforces the design rationale. The best forecasters are those who systematically challenge their own assumptions. Surowiecki’s work [9] on collective intelligence demonstrates that group judgement outperforms individual expertise only under conditions of diversity, independence, and structured aggregation. The Risk Simulation Lab creates precisely these conditions, providing diverse perspectives, forced independent assessment, and structured observation of the governance response.
Consensus dependency Primary defect addressed: Consensus dependency. The Risk Simulation Lab forces decision-making under adversarial conditions that prevent the social dynamics (anchoring, conformity pressure, deference to seniority) that produce consensus without rigour. It reveals whether governance decisions are products of structured analysis or artefacts of group dynamics.
The Pre-Mortem Diagnostic
Intellectual Origin
The pre-mortem technique was developed by Gary Klein and published in the Harvard Business Review [10]. Klein’s method inverts the conventional post-mortem. Instead of analysing why something failed after the fact, participants imagine that a project or decision has already failed catastrophically and work backward to identify the most likely causes.
The technique exploits a cognitive phenomenon known as prospective hindsight. Research by Mitchell, Russo, and Pennington [11] demonstrated that imagining an event has already occurred increases the ability to identify its causes. The pre-mortem transforms a question of prediction (“what could go wrong?”) into a question of explanation (“why did it fail?”). The human mind is significantly better at explanation than prediction.
The technique also serves a social function that is directly relevant to governance. In a conventional risk discussion, raising concerns about a proposed strategy can feel adversarial. The person raising the concern is challenging the consensus and may face social pressure to conform. In a pre-mortem, the failure is stipulated. Every participant is asked to explain it. Dissent becomes the task, not the exception. The pre-mortem gives permission to speak truth to power.
Definition and Operation
The Pre-Mortem Diagnostic applies Klein’s technique to governance decisions before major capital commitments, strategic shifts, or structural changes. The SGaaS principal facilitates a series of structured sessions in which participants are told: “It is twelve months from now. This decision has failed catastrophically. What happened?”
Participants work independently before group discussion, a direct application of Kahneman, Sibony, and Sunstein’s decision hygiene principle that independent assessment must precede group synthesis. Each participant identifies the most plausible causes of failure from their own perspective and expertise. The principal then aggregates and structures the responses, identifying clusters of concern, areas of divergence, and failure modes that no single participant identified but that emerge from the collective analysis.
The output is a structured failure-mode map, a documented catalogue of the ways in which the decision might fail, weighted by frequency of identification and assessed for plausibility. This map does not tell the board what to decide. It tells the board what it is risking, and it does so with the benefit of the 30% improvement in causal reasoning that prospective hindsight provides.
Within the SGaaS model, the Pre-Mortem Diagnostic is a decision prerequisite, not a periodic review exercise. It is embedded into the governance process at the point of maximum leverage. This timing is what addresses the structural defect of episodic engagement. By activating risk engagement at the decision point itself, rather than in post-decision review, the Pre-Mortem Diagnostic shifts governance from periodic compliance to decision discipline.
Episodic engagement Primary defect addressed: Episodic engagement. The Pre-Mortem Diagnostic makes risk engagement a prerequisite of significant decisions, not a periodic review conducted between them. It ensures that governance challenge occurs at the moment of maximum leverage (before the decision is made) rather than at the moment of minimum leverage (after the decision has been implemented and the organisation is committed).
The Integrated Methodology
The three tools are designed to operate best as an integrated system, but the use, scale and prominence of each tool is bespoke for each client.
| Tool | Function | Primary Defect | Timing | Output |
|---|---|---|---|---|
| Red Team Protocol | Adversarial assessment of plans, frameworks, and decisions | Absence of challenge | Continuous: applied on a retained basis across governance cycles | Structured challenge briefs; assumption maps; adversarial intelligence |
| Risk Simulation Lab | Scenario-based stress test of governance behaviour under crisis | Consensus dependency | Periodic: calibrated exercises at defined intervals or ahead of strategic inflections | Observed evidence of governance response; decision-making diagnostics |
| Pre-Mortem Diagnostic | Failure-first analysis before major decisions | Episodic engagement | Event-driven: deployed before significant capital, strategic, or structural decisions | Failure-mode maps; weighted risk catalogues; decision-readiness assessments |
In a typical retained SGaaS engagement, the three tools interact as follows. The Red Team Protocol operates continuously, providing ongoing adversarial intelligence on the organisation’s governance architecture, strategic assumptions, and decision quality. The Risk Simulation Lab is deployed at defined intervals (typically quarterly or semi-annually) or ahead of significant strategic inflections, stress-testing the governance response under controlled adversarial conditions. The Pre-Mortem Diagnostic is deployed as decisions approach, ahead of major capital commitments, strategic shifts, and structural reorganisations.
The three tools share a common design philosophy with two operational principles. First, the analytical burden is carried by the SGaaS principal, not the board. Assumption mapping, adversarial scenario construction, document review, and coordination with the second and third lines are conducted asynchronously alongside the organisation’s existing governance rhythm. Part-time directors receive distilled, high-signal adversarial intelligence rather than raw analytical workload. Second, directors are not passive consumers of that intelligence. Forced independent deliberation (anonymous pre-deliberation assessments of confidence and risk) precedes every structured challenge output, ensuring that the board engages cognitively with the decision before receiving the adversarial analysis. The tools differ in their scope (architecture vs. behaviour vs. decision), their timing (continuous vs. periodic vs. event-driven), and their primary target (the third, second, and first structural defects respectively). Together, they constitute a comprehensive challenge methodology that addresses all three structural defects simultaneously while respecting the cognitive constraints of board-level governance.
The methodology in summary. SGaaS does not rely on a single technique. It deploys three integrated tools, each grounded in established intellectual traditions, each addressing a specific structural defect, and each operating on a different cadence. The Red Team Protocol provides continuous challenge. The Risk Simulation Lab stress-tests governance behaviour at defined intervals. The Pre-Mortem Diagnostic embeds risk engagement into the decision process itself. Together, they provide the sustained, adversarial, evidence-based challenge that the preceding sections have shown is missing from conventional governance architecture.
Section 10 presents the four-tier retainer model through which this methodology is delivered.
References
- Karl R. Popper. (1963). Conjectures and Refutations: The Growth of Scientific Knowledge. Routledge and Kegan Paul.
- University of Foreign Military & Cultural Studies. (2012). Red Team Handbook. U.S. Army University of Foreign Military and Cultural Studies, Fort Leavenworth.
- Bryce G. Hoffman. (2017). Red Teaming: How Your Business Can Conquer the Competition by Challenging Everything. Crown Business.
- Micah Zenko. (2015). Red Team: How to Succeed by Thinking Like the Enemy. Basic Books.
- Andr\'e Brodeur et al.. (2010). A Board Perspective on Enterprise Risk Management. McKinsey & Company.
- Ryan Luttenton et al.. (2026). From Guidance to Action: Exploring Practical Enterprise Risk Management. Committee of Sponsoring Organizations of the Treadway Commission (COSO).
- Nassim Nicholas Taleb. (2007). The Black Swan: The Impact of the Highly Improbable. Random House.
- Philip E. Tetlock & Dan Gardner. (2015). Superforecasting: The Art and Science of Prediction. Crown Publishers.
- James Surowiecki. (2004). The Wisdom of Crowds: Why the Many Are Smarter Than the Few and How Collective Wisdom Shapes Business, Economies, Societies and Nations. Doubleday.
- Gary Klein. (2007). Performing a Project Premortem. Harvard Business Review.
- Deborah J. Mitchell et al.. (1989). Back to the Future: Temporal Perspective in the Explanation of Events. Journal of Behavioral Decision Making.