And that's where you both implement and act on security policies to mitigate and avoid this based on the threat model you're up against.