“In order for address, for us to continue doing the job, we have to address it in a risk-based approach, identifying what should we be working on because we probably can't work on everything.”

Transcript evidence from Jet Anderson -- The AppSec Code Doctor.