CISOs and their security teams are frequently confronted with this critical question. To confidently answer, “Yes,” an organization needs to understand the effectiveness of its security defenses and prevention capabilities ensure that these controls are as working as expected. Prevention starts with proactive threat intelligence on who or what may be targeting the organization and other organizations in similar industries or the same region. Organizations also need to continually run automated evaluations of those specific threats against their prevention security controls.