“The key thing over here is you have to take risk within what we call the risk appetite.”

Transcript evidence from Irfaan Santoe -- The Power of Strategy in AppSec.