include but it's not limited to the activities like performing security tests, 3rd party component security monitoring...