Finding the Right Mix of Preventive and Detective Controls: Metric of the Month