least, the possibility of the US-based developer as an insider threat has been
considered. Still unresolved, at least to some extent, is the definition of what
code actually is malicious. Definitions that designate any undocumented
Software Security Assurance State-of-the-Art Report (SOAR) 289