to mathematically model and quantify the survivability of a softwarebased system to what he terms “human sponsored” (rather than
stochastic) faults. Quantification is achieved using mean time to
discovery of a vulnerability [134] as the metric, i.e., the longer a
vulnerability goes undiscovered due to lack of activation of the