Is it cheaper to find and prevent ALL vulnerabilities than to find and exploit ONE?