4 questions to ask before enacting an evidence-based approach in Security