Someone asked me a question next to water cooler:

It is unrealistic for us to catch all of the security loopholes, so why do we still execute security tests?

I was speechless, could not provide any answer.

2 Answers 2


It is not just security testing, testing, in general, can not find all of the bugs, there is no guarantee that a system can be free of bugs or free from attacks.

But the purpose for us to execute security tests or software tests, in general, is not to find all of the bugs.

The purposes are:

  1. Identify risks and evaluate the effectiveness of existing security defenses. / Evaluate current software quality
  2. Security testing/software testing shows our due diligence has been performed in protecting digital assets / improving software quality
  3. In event of legal actions, we have proof that we have taken steps to protect sensitive information / improving software quality

Every complex system is like that.


Defense in depth is also used in real life: If security belt in cars don't prevent all car deaths, why we still use them? If anti-aircraft defense does not shot all bombers, why we bother? Because results with using more layers of defense are better than using only a single layer of defense.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.