Most security providers can describe what they should be able to do. Fewer can demonstrate what they actually see, track, and respond to in live environments.