software programs (the Microsoft metric) orthe average number of vulnerabilities
per x lines of code are, in fact, meaningful metrics in terms of indicating whether
efforts to produce more secure software have succeeded, orfor predicting the
likelihood that software that appears to be secure in the development environment