Testing the limits of cyber security