Putting in place checks to keep out little and funny bugs, breaking the bits of the software just like the attackers to see what's left to be done, doing risk assessment to help determine what matters and what doesn't, keep up with security policy without compromising users and companies needs and reducing security debts