As someone who has spent their entire life on the blue team, I've used some of these red team tools to assess my effectiveness. I can remember using Metasploit

As someone who has spent their entire life on the blue team, I've used some of these red team tools to assess my effectiveness. I can remember using Metasploit to make as much noise as possible to test my team's responsiveness to our SIEM going crazy with alerts. We've used Burp and similar tools to perform security audits of the company's custom code, and audits of software we're doing a PoC with to ensure quality. I've never once worried that the tools I'm using would end up in the hands of more sophisticated hackers. If anything, I'm glad for the basic red team tools because it makes script kiddies easier to find. They're not going to do custom exploits anymore when Metasploit exists. On the other side, it's almost always a safe bet that the actual bad guys are going to skip the off-the-shelf tools... ... assuming, of course, you have a decent enough security posture as-is. If script kiddies and ransomware and Zeus can get into your network unnoticed, you've got a much larger problem on your hands. Unfortunately, most companies still fall into this category because even companies that spend tens of millions of dollars on security don't take basic security seriously.