Adapting Your Mindset for Auditing Cybersecurity | The Skeptical Auditor