326 This is, in fact, true of the growing interest in software security generally. It is widely reported that no
real business case has been made to justify investment in software security, and no return-oninvestment statistics have yet been captured. And yet the level of discussion, publication, and activity
(i.e., buzz”) about software security continues to grow along what appears to be an increasingly steep
upward trajectory. Is it a matter of the tail wagging the dog? Is all the “buzz” actually creating an