Premise: Reviewing and testing the security features in both commercially developed software that was being considered for use and internally developed software prior to its being moved into production.

Hypothesis: They aren't as thorough as they should be in their review. 
Relation: neutral