How do you know you're creating real security?

Tools aren't the place to start, but they'll get you to the finish line.