As someone who has been engaged by consulting clients and full-time employers to conduct threat assessments and write security and emergency preparedness plans, I am often left puzzled by how many organizations go to great lengths to assess their vulnerabilities and create plans to address them, but almost never test their ongoing effectiveness.
