Checking Boxes vs. Proactive Security