*to either coming up with a defense-in-depth strategy that assumes layers will be compromised and protects what you specifically care about
or, equally reasonably, to something else that’s more immediate and important to your project (like more commonly exploited vectors, incident recovery strategies, or just generally improving your product!)