Lunch and Learn: Deconstructing real attacks and breaches