the metrics and measurement community, which is attempting to define such
metrics, regarding exactly what can and should be measured as a meaningful
indicator that software is actually secure (or not vulnerable).
In August 2006, the first-ever conference devoted to security metrics,