You can never prove a scientific hypothesis to be true. Can’t be done. The best you can do is support it with your tests and experiments. More experiments lead to stronger support of the hypothesis. But, you can’t ever prove it to be true, because, even if you’ve run a million experiments that support a hypothesis, it might be the very next one – the one you didn’t think of – that proves it to be false. It takes only one instance to prove a hypothesis false. IT security is a lot like that.