That is advice I gave a consulting client the other day: assume that you cannot prevent every attack from making it through, so focus your engineering efforts on what happens when an attack DOES get though

→ View original post on X — @simonw