Three of the biggest security programmes hit the same wall. The model finds the vulnerability, but it cannot tell you whether the vulnerability is real.