Pick a production host. Produce a 2-page threat model (STRIDE per surface, residual risks listed), a CIS Level-1 compliance scan with deviations documented, and one runbook for a high-likelihood detection scenario. Walk a teammate through executing the runbook.