Unhealthy security systems rarely fail overnight. They erode slowly, masked by routine and good intentions. But institutions have a critical responsibility to remain vigilant and to measure, test, and ...