Penetration testing simulates realistic cyberattacks to allow agencies to think like an adversary and uncover hidden vulnerabilities