This post seems very concerned about what a product does - and rightly so. However, it doesn't really talk about figuring out what a product doesn't do. This is a blind spot large enough to fly a 747 full of CVEs through.