You have run your favorite automation tool. You’ve sifted through the results, suppressing duplicates, false positives (there aren’t many tools that automatically detect ARIA and suppress reporting the underlying issue that the ARIA addresses), and things that are not within your control to fix, then condensed down the patterns — who wants to file 827 independent “the alt text on this image is empty” defects?. Then, you have carefully augmented those results with manual testing results.