Currently, existing and proposed software security metrics focus almost
exclusively on counting and comparing vulnerabilities in implemented software,
measuring the attack surface, or measuring complexity. No one has yet determined
whetherthe comparison of numbers of vulnerabilities in earlier vs. later versions of