Conduct penetration testing, vulnerability assessments and purple team exercises to find and report security gaps.