By allowing such tests, the organizations could readily identify previously unknown vulnerabilities and either eliminate them or make adjustments in computer and network use to lessen the risks.
The tests take a lot of money and effort, but their effects are worth it.