“Most of the time when security appears to be working, it’s because no adversary is currently prepared to attack.”