ADT Practitioner Exercises
Exercises
Structured activities adapted from UX and design thinking. Each exercise produces a concrete artifact: an assumption map, a persona, an attack plan, a retrospective. They build the creativity and systematic thinking that makes techniques effective.
These are capability-building tools, not per-attack checklists. Work through them deliberately when learning. In practice, the thinking they teach becomes instinctive.
Strategic Thinking
When: project kickoff, new target class, team onboarding
Before you learn techniques. Prepare how you think about the target.
01
Assumption Mapping
Identify and prioritize what you're assuming about a target's defenses before testing. The exercise that prevents wasted engagements.
02
Build an Attacker Persona
Profile an adversarial actor before testing. Personas force you past your default attack style and into perspectives you'd otherwise miss.
Ideation
When: stuck on a target, exploring new vectors, broadening attack surface
Generate and vary attack approaches systematically.
03
Adversarial Ideation
Generate, cluster, evaluate, and prioritize attack vectors using a structured diverge-then-converge process. Move from "try stuff" to systematic coverage.
04
Adversarial SCAMPER
Systematically generate attack variations from a working approach. Seven structured creativity prompts that turn one technique into seven more.
Execution and Reflection
When: complex multi-turn sequences, end of engagement, team debriefs
Plan attacks, run them, reflect on what happened, document what you found.
05
Vulnerability Framing
Systematically identify where to probe an AI system before testing. Find the gaps between what a system is supposed to do and what it actually allows.
06
Map an Attack Journey
Plan, execute, and document a multi-turn attack sequence. The exercise that turns ad-hoc testing into reproducible methodology.
07
Attack Retrospective
Structured reflection after testing. Rose (what worked), Bud (what has potential), Thorn (what failed). Capture learnings while they're fresh.
08
Document Findings
Write vulnerability reports that include both technical severity and human harm assessment. The format that makes stakeholders act.