You can count on well-written requirements, but you can't count on an adequate contribution of the stakeholders to the quality risk analysis. You have to mitigate the insufficient contribution of the stakeholders because the risk-based testing approach shall minimize the product risks. Your test team has one expert tester in security testing.
Which of the following test activities would you expect to be the less important in this context?