Effective resilience requires more than just security tools