Assume the Attackers Are Already Inside – Now What?