What security data isn't telling you