The team may follow the secure coding standard updates dependencies, yet ship a vulnerability which did not get noticed. Real attacks don’t follow an audit