Metrics for software assurance are still in their infancy, as evidenced by the strong
emphasis on statistical analyses based on published vulnerabilities. However, we are
likely to see significant gains in the next year or two. Some security-relevant metrics are
being developed that evaluate a product on a macro level, typically using automated