“I would start with setting the baseline.”

Transcript evidence from Irfaan Santoe -- The Power of Strategy in AppSec.