If you want to know about which cyber defenses are most effective and which are a waste of money and resources, ask a hacker. And that’s just what Nuix researchers did.

“During Black Hat USA and DEF CON 24 in 2016, we conducted a survey of known hackers, professionally known as penetration testers, and asked about their attack methodologies, favorite exploits, and what defensive countermeasures they found to be the most and least effective—and many other questions,” the company noted in a recently released report.