Why security validation must follow the attack path