This is a great distinction. Right now all our scenarios are postmortem replay - you're dropped in after things have already gone wrong. But a pre-incident mode where you're reviewing a setup and have to spot the misconfiguration before it blows up is a really interesting idea. Different skill, equally important. Adding it to the roadmap.