and software users, moving them away from exclusive reliance on application
security (defense-in-depth [DiD]) measures and “penetrate-and-patch”
activities toward the recognition that the way to deal with vulnerabilities
292 Software Security Assurance State-of-the-Art Report (SOAR)