CTFs and bug bounties are good. Better is when people have broken something for themselves, and best is when they've made money doing it. I trust that those people know how to think like the attackers I should be really worried about.