Trend analysis (e.g., how big of a problem is memory safety compared to other problems like injection?).
Further insight to potential “exploitability” based on root cause (e.g., command injection vulnerabilities tend to see increased adversary attention, be targeted by certain actors).
Organizations demonstrating transparency to customers about how they are targeting and addressing problems in their products.
Today, however, root cause mapping is not done accurately at scale by the vulnerability management ecosystem. The CWE Program’s new and improved guidance addresses this problem.