“You have to think about what does the application allow to be done that shouldn't be happening or shouldn't be allowed.”

Transcript evidence from Dave Ferguson -- The OWASP Top 10 Proactive Controls.