actually says something meaningful about the security of the software. In short,
given a statistic such as number of faults detected in source code, is it possible
to extrapolate something about the influence of that statistic on the security
of software compiled from that source code, i.e., do fewer faults in source code