Real security isn’t about preventing the first breach — it’s about being the one who gets called after everyone else failed