Stop Using Vulnerability Counts to Measure Software Security.

This article argues that counting fixed vulnerabilities is a misleading measure of software security, as it ignores the context, effort, and process improvements behind each fix. Vulnerabilities are discovered under varying conditions, influenced by factors such as tool advances, human diligence, an...

Full description

Bibliographic Details

Published in:	Communications of the ACM Vol. 68; no. 9; pp. 34 - 37
Main Authors:	Meneely, Andy, Keller, Brandon
Format:	Article
Published:	Association for Computing Machinery Sep2025
Subjects:	Computer security vulnerabilities Computer software security Software measurement Corporate culture Software architecture Internet security
Online Access:	View this record in EBSCOhost