AppSIC’s first deliverable, in July 2006, was a position paper entitled
What Security Means to My Business that attempts to capture a business case
for software security and to lay the foundation for metrics for measuring
business risk that stems from insecure software, with a view towards