have vulnerable software). In short, without means to measure the effectiveness
not just of whole processes but of individual practices and techniques, under
specific circumstances and in particular environments, software security still
appears to be a daunting all-or-nothing proposition.