Why are we still doing perfunctory penetration testing when we can be emulating realistic threats and stress-testing the systems most at risk?