Researchers with Google and a handful of universities believe security practitioners need to focus on evaluating how cybercriminals adapt to interventions instead of trying to protect users.