There's a difference between, say, the local bank claiming to have a giant safe that's rated TL-30 but it turns out to actually be rated TL-15 while the bank ac

There's a difference between, say, the local bank claiming to have a giant safe that's rated TL-30 but it turns out to actually be rated TL-15 while the bank across the street also claims to have a TL-30 rated safe when in actuality it turns out that during installation someone smashed a 4ft by 4ft hole through the safe then covered it over with aluminum foil. There are the inevitable almost impossible to fully plan for security vulnerabilities (e.g. in code outside your control) and then there are vulnerabilities due to extremely poor process at a fundamental level (like sql and html injection).