War games about China hacking water systems. Insurance companies running tabletops. Here's what I learned building security companies: the simulation is never the problem. It's believing the simulation prepared you for anything real.