How can you tell if a security test is useful or not?