One of the first changes security teams need to make is how they understand adversarial capabilities — always assume the perimeter has already been breached.