Why Your Monitoring Program Is Letting Attackers Win