improve the security of custom-built software, there is little empirical evidence
showing the return on investment (ROI) or success of these various techniques.
Organizations like SEI, DHS, and DoD are looking into methods to estimate the
ROI of the various techniques to aid organizations in deciding what security