u The software is written in a type-safe language (e.g., Java or C#); therefore,
buffer overflows are impossible and security has been addressed.
For a small subset of software, such assumptions may be valid. However, it is
likely that the assumptions may become invalid by the end of the SDLC: mandatory