and attackability. The CMU metric is more generic than RASQ and thus
applicable to a wider range of software types. In their paper,
Manadhata and Wing calculate the attack surface for two versions of a
hypothetical e-mail server. However, the CMU attack surface metric is