Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper critiques the current landscape of automated vulnerability discovery, arguing that the focus on discovery and repair costs overlooks the critical factor of remediation coverage at the point of release. It highlights that the unaddressed vulnerabilities that organizations choose to ship are not randomly selected but are influenced by triage processes that prioritize cost over architectural significance. The authors assert that without measuring release coverage, organizations remain exposed to legal and market risks, as existing regulations fail to address internal knowledge of vulnerabilities effectively.
Organizations may be shipping software with unremediated vulnerabilities that could significantly impact their legal and market standing, yet they lack the metrics to understand their exposure.
Automated vulnerability discovery has removed the scarcity of expert attention that protected most software. The response has concentrated on discovery and on repair, and both are becoming cheaper. This article argues that neither cost curve determines exposure. What determines it is remediation coverage at the release decision: the fraction of identified vulnerabilities fixed before a product ships, and the residue of known, assessed, unremediated flaws an organisation has decided to ship with. Four arguments follow. The residue is not a random sample of what was found, because triage sorts on cost and the expensive cases are architectural. The deferred backlog is itself a high-value artifact. Documented awareness alters an organisation's legal and market position, and produces an adverse selection that the price of software does not reflect. And no regulatory instrument reaching vendors triggers on internal knowledge -- every one fires on exploitation observed by a third party -- which leaves the distance between what a vendor knows and what it must disclose entirely at the vendor's discretion. CISA's Binding Operational Directive 26-04 is examined as the exception that shows what a solution requires. Release coverage is not currently measured, and measuring it is the precondition for liability, insurance or procurement to act.