Consider the scenario where you outsourced a project to a development house. Once they have finished and you approved the functionality, they deploy the product in a production environment and maybe have the system hosted if it is an online system. Have they educated you on the security risks in exposing a server to the Internet? Have they locked down the server and hardened the services running on it? Have they used defensive coding methods to make their code more robust? Do they understand wat an SQL injection attack is?