“If some of those applications are not using frameworks, probably you should put them on top of your list, and you should have monitoring or protections on top of that.”

Transcript evidence from Aviat Jean-Baptiste — The AppSec report.