Security bugs - and not bad security processes, are a small subset of bugs.