Knowing what exploits are like in the private/state sector that seems like a no-brainer if your threat model includes a well-funded attacker.