I recently wrote on something similar. I think the way we design evaluation methods for students needs to mirror the design of security systems. https://kelvinpaschal.com/blog/educators-hackers/