i am not ok with that being a reason why i can't have a human learn and grow by mapping penetration test findings to STRIDE and then mapping that to controls and then risks.