How to use red teaming to find real-world vulnerabilities