What do security teams really want?