Is your company getting the security it's paying for? Here's how to find out.