“In non-production environments before they launch an attack against a production.”

Transcript evidence from JB Aviat -- The State of Application Security.