Red team, blue team: How to run an effective simulation