Recent penetration testing of an organization's software has identified many different types of security risks. Which of the following is the MOST likely root cause for the identified risk?

SIEM software producing faulty alerts is an operational issue related to monitoring, not a root cause for fundamental security risks in software design or development itself.

Threat modeling is a structured approach to identify potential threats and vulnerabilities early in the software development lifecycle, during the design phase. If threat modeling was not utilized, security risks would not be identified and addressed proactively, leading to numerous vulnerabilities being discovered later during penetration testing.

Inconsistent configuration management could lead to some vulnerabilities, but a wide variety of risks points to a more fundamental issue in initial security design rather than just configuration.

Improper integration of an IAM tool would lead to specific authentication/authorization vulnerabilities, but 'many different types of security risks' suggests a broader failure than just IAM.