Security strategies must be defensive and investigator