the next year or two, additional software assurance metrics are expected to be introduced,
such as the Security Quality Score announced by Veracode in June 2007 [Wysopal], or
upcoming Web Security Evaluation Criteria by OWASP [Curphey].
Unfortunately, these metrics assume that a comprehensive analysis can be performed,