There are many different tests you can run to assess your readiness to face an attack. The longer a broadly-known vulnerability is present in your environment, the more readily an exploit for it is available, the worse you score on such a test. Test tests focus on a single step of a cyber-attack and thus dont provide a simulation of an actual advanced attack. For this, security teams within companies generally rely on red teams which make the evening news involve attackers getting past your initial line of defense.”]
Source: https://www.csoonline.com/article/3241889/how-ready-are-you-to-stop-an-advanced-attack.html