The Attackers Already Know Your “Assume Breach” Strategy