number of vulnerabilities for an application, this has not been sufficiently proven, and
one could construct pathological cases that would demonstrate that this correlation is not
universally true. Traditional software metrics such as code size and complexity might
also be useful in assessing security, but more work is needed here, too. Threat modeling