“Bad guys attack, and good guys react” is not a viable security strategy.”