Red teaming exercises not only test an organization’s security framework but also train responders to think more like attackers