[whatupmiked]

| 10. Unrestricted Code Execution | If unverified programs are allowed to execute on hosts, a threat actor can run arbitrary, malicious payloads within a network.

The list was good but this last one reads more like end-point security.