“Root cause mapping” is the identification of the underlying cause(s) of a vulnerability. Accurate and precise root cause mapping is valuable because it directly illuminates where investments, policy, and practices can address the root causes responsible for vulnerabilities so that they can be eliminated. This applies to both industry and government decision makers.
Additionally, it enables:
Driving the removal of classes of vulnerabilities: Root cause mapping encourages a valuable feedback loop into a vendor’s software development lifecycle or architecture design planning.
Saving money: the more weaknesses avoided in product development, the less vulnerabilities to manage after deployment.