Assessment: Surge fails to provide significant security gains