Calibrating a security strategy