We observe very clearly that teams consistently fail to write vuln-free C applications of any meaningful technical or organizational complexity. Following various guidelines empirically does not solve the problem.