If the time an attacker takes to break through the organization’s preventive controls is shorter than the sum of the time required for the organization to detect the attack and the time required to respond to the attack, then organization’s security is considered____.