This paper is intended to spark discussion in the research and consumer communities, and
to encourage the development of metrics for software assurance. VAAL, or a variation of
it, could also be useful in evaluating the skill levels and diligence of vulnerability
researchers and code analysis tools. VAAL-based metrics could be devised for