My long-time corporate employer used 3 network security teams, cooperating but competing...
One of course examined external 'threats'. Their definition of 'threat'? traffic. All incoming network traffic was a threat.
The next examined all internal 'threats'. Uh, they meant traffic, of course.
The third had several roles. First, they actively and continuously challenged both of the threat teams. A former team member regaled me with stories of copycatting a newly discovered vulnerability, hammering both teams as they could. They made outright attempts looking like black hats. And they employed hosts worldwide, to more fully emulate the real threat actors. While both other teams may have employed honeypots, this challenge team most certainly did. They had the best times, trolling CVEs and those great Internet security mailing lists to beat the bad guys to the fix.
And this weas for a business that also had to protect against frauds of several flavors, which meant there were two (or more, I do not really know) teams working at different levels or vectors of frauds. Great fun.
I wished sometimes I was in that group, but after a 20 year career in small business It, and the rapid changes in data security, I do not miss it. Having a mail server and a WordPress server is enough. Having been baptized into Internet security thanks to cDc, I became a bit cynical. They are not forgiven...