Driving the removal of classes of vulnerabilities: Root cause mapping encourages a valuable feedback loop into a vendor’s SDLC or architecture design planning
Saving money: the more weaknesses avoided in your product development, the less vulnerabilities to manage after deployment
Trend analysis (e.g., how big of a problem is memory safety compared to other problems like injection)
Further insight to potential “exploitability” based on root cause (e.g., command injection vulnerabilities tend to see increased adversary attention, be targeted by certain actors)