Great points indeed. As for your proposition - I agree. A simple way to do this would be to have, for example, a day a month where the organization's engineers

Great points indeed. As for your proposition - I agree. A simple way to do this would be to have, for example, a day a month where the organization's engineers try to break into their own system. It's common to write tests and follow best practices here and there, but developers often won't actually dedicate some serious time to actively try to break into their own system as an attacker. I think this could be fun and beneficial for all involved.