An organization has not had an incident for several months. The Chief Information Security Officer wants to move to a more proactive stance for security investi...