And that's the category I mentioned earlier. If you have a system and it's security has never been tested by attempting to breach it, then you don't know that it's secure.