A common misconception in cybersecurity is that red and purple teaming exercises are only useful in identifying vulnerabilities before an attack occurs.