there no implementation faults, the software could exhibit overall weakness due
to inadequacies in its design and architecture. This type of inadequacy is much
harder to pinpoint, let alone to measure.
Researchers involved in defining metrics for software security do not