Uncomfortable truths of endpoint security