https://www.pivotpointsecurity.com/devsecops-depends-on-understanding-application-specific-risk/