page at http://cwe.mitre.org/top25/process.html .
To help characterize and prioritize entries in the Top 25 CWE list, a threat model was developed that identified
an attacker with solid technical skills and determined enough to invest some time into attacking an organization.
Weaknesses in the Top 25 were selected using two primary criteria: