For routine vulnerabilities, the TR will suggest alternative coding
patterns that are equally effective but which avoid the vulnerability or
otherwise improve the predictability of the compiled program’s execution.
When such measures are not possible, the TR may suggest static analysis