“We go over those risk profiles, we go over the data, and when we prioritize what application should we pentest next, we take that list, but we don't only look at the high ones.”

Transcript evidence from Alex Mor -- Application Risk Profiling at Scale.