You never have all of the facts at the start of any project, so making only one pass through the process can potentially leave the application vulnerable to attack.