What if a requirement is “system is secure from cyber attackers”? I had a discussion the other day about how to tell when a web service can really be considere

What if a requirement is “system is secure from cyber attackers”? I had a discussion the other day about how to tell when a web service can really be considered secure enough for somebody important to store sensitive data on (Eg, medical software); when do you say “the requirement has been met”? Does it become un-met next week when a new exploit is discovered in a package you rely on?