Quality Is Security Most security problems are simple bugs Better quality, better security There is no "security plugin" No return on investment for security but shorter test cycles less bugs, less time spent on fixing them better efficiency