Unit testing coverage is a development practice, not really a defense. Testing, coverage, static analysis, methodologies, etc... are a way to make prevent thin

Unit testing coverage is a development practice, not really a defense. Testing, coverage, static analysis, methodologies, etc... are a way to make prevent things from going wrong in the first place, defenses are here to protect you if things go wrong. We need both. The article focuses only on the "defense" part, the development practices could make another article. Note that testing and defenses can go together: test to make sure all paths are taken before shipping, and see if defenses trigger. Fuzzing in particular takes that approach.