When a detection tool fires no alert, how to tell the difference if the environment is safe or just something is wrong with the tool

Question

For example, if an antivirus gives no alert for a couple of months, how do you confirm if the antivirus is working to prevent viruses, and not just hung?

Answer 1

You test it with simulated malware.

This could be anything from a simple EICAR test file (to confirm that it's actually running and doing what it should) through to red-team style engagements where you have people developing and deploying custom "malware" implants in your network to see if they're detected.