for increasing the likelihood of correctness.
Whether vulnerabilities exist often depends on the implementation details
of the components identified in the design. Furthermore, exploits often attempt
to change the environment and inputs to a system in ways that are difficult to