Software engineers generally lack confidence in COTS (and to a lesser extent
open source) components because they cannot assess the compatibility
between the components’ security properties and the security requirements
of their own applications.