Actively defending pen testing assets