The push only involved auditing use of APIs. High-level decisions were, generally, not re-thought. For a more concrete example, if you were hosting IE within a

The push only involved auditing use of APIs. High-level decisions were, generally, not re-thought. For a more concrete example, if you were hosting IE within a window of your process, you had to harden the heck out of anything that IE could host, how it accessed URLs and the hosting environment, etc. But, nobody was going to ask you WHY you were hosting IE in the first place.