Prove your security actually works