Day Zero is a Day Too Late: The Real Cost of Reactive Security Tools