...which could be much more expensive and sill not find the error you'd need to defend the client. You'd essentially be black box testing without even knowing what kind of errors you want to find. Or am I missing something?