evidence that any of these secure software methodologies has been used in realworld software development beyond a few relatively small pilot projects (either
purely academic, or under the auspices of academic–industry partnerships).
Microsoft alone has published some crude metrics (comparing numbers of
vulnerabilities in pre-SDL and post-SDL versions of strategic software products)