“Capture-the-flag evaluations or honey pots with outcome rewards can be used to measure if a policy has successfully circumvented a control technique.”