Be the threat: Case for hands-on threat simulations in cybersecurity