OpenAlex ·
After Cheap Discovery: From unknown to known-and-unfixed
- Published
- Source
- OpenAlex
- Published in
- arXiv (Cornell University)
- DOI
- 10.48550/arxiv.2609.03266
- Original
- Read it at the publisher
- Topics
Abstract
Automated vulnerability discovery has removed the scarcity of expert attention that protected most software. The response has concentrated on discovery and on repair, and both are becoming cheaper. This article argues that neither cost curve determines exposure. What determines it is remediation coverage at the release decision: the fraction of identified vulnerabilities fixed before a product ships, and the residue of known, assessed, unremediated flaws an organisation has decided to ship with. Four arguments follow. The residue is not a random sample of what was found, because triage sorts on cost and the expensive cases are architectural. The deferred backlog is itself a high-value artifact. Documented awareness alters an organisation's legal and market position, and produces an adverse selection that the price of software does not reflect. And no regulatory instrument reaching vendors triggers on internal knowledge - every one fires on exploitation observed by a third party - which leaves the distance between what a vendor knows and what it must disclose entirely at the vendor's discretion. CISA's Binding Operational Directive 26-04 is examined as the exception that shows what a solution requires: a regulator's reach over a decision is bounded by its visibility of the input to that decision, so a duty attaching to internal knowledge needs an independent record of that knowledge to attach to. Release coverage is not currently measured, and measuring it is the precondition for liability, insurance or procurement to act.
The authors’ abstract, as arXiv lists it. arXiv’s listings, abstracts included, are free for anyone to reuse.
Read it on ReadSearch
Each opens after you create an account, and brings you back to this paper.
More in Databases
Concord: A Video Relational Algebra for Cross-Modal Query Optimization
Nebulon Enterprise Simulated Threats for Phishing Research (NEST-Phish): A Synthetic Enterprise Phishing Email Dataset for Behavioral and Machine-Learning Research
Software Engineering in the Agent Era From Trustworthy Change to Human Agent Software Organizations
Recommender System as Slow and Fast Thinkers
Cadence: Error-Bounded Lossy Compression of Demand Time Series with a Time-Series Foundation Model
Get the few papers worth your time in Databases every morning.
ReadSearch reads the new papers in your field each day and brings you the few worth reading, each with its key finding in a sentence.