More than half of enterprises don’t know if their security tools are working