component may be exposed to inputs with which it has not been previously
been tested. Thus, it may introduce vulnerabilities into the new system. In one
case study, vulnerabilities were minimized by designing a “system (that) places
no reliance on COTS correctness for critical security properties.” [214]