What is really required to address security gaps properly?