This talk explores whether the focus on security testing has overshadowed, if not negated, more effective application security practices. It examines the benefits and drawbacks of security testing, highlights real-world examples, and advocates for a world where security is threat-based and responsibility for testing moves inside the development team.