Synthetic data allows regulators to test the resilience of critical infrastructure defenders under extreme hypothetical scenarios.