Should I invest in attack simulation tools?