Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What fraction of software bugs are security vulnerabilities? Obviously, software bugs can be security vulnerabilities -- but also obviously, many software bugs have little or no security impact. Is there any data (or rules of thumb) on roughly what fraction of software bugs are also security vulnerabilities? Or a rough range of values?

share|improve this question
The catch is that as research progresses, existing non-security bugs can become security issues as people figure out how to exploit them. It would be interesting if people did the math though. But while we know how many security vulnerabilities get reported in popular software, we don't know how many bugs there are. Nor is there much consensus on what constitutes a bug (versus an undesired feature). – tylerl Jun 22 '13 at 8:02
Depends a lot of programming language, maturity of software, what you count as vulnerability/bug... Many vulnerabilities are configuration errors or mismatches between the user's/admin's mental model and the model the software assumes. – CodesInChaos Jun 22 '13 at 8:02

Well, obviously any estimate is going to fairly hand-wavy, since if we knew the existence of all bugs and could enumerate them, then the bugs probably wouldn't have shipped. So these bug counts are based on bugs found after the fact. Scrutinized software will naturally have proportionally more of its bugs discovered than rarely used software, so our measurement technique is biased.

But here's a post that references Code Complete saying 10-15 bugs per KLOC:

And here's a post right here on SO that estimates security bugs at at a max of .05 security bugs per KLOC:

Average number of exploitable bugs per thousand lines of code?

So one rough estimate to your answer is .05/15 = .003333. It's a fairly small proportion.

share|improve this answer

So how many security flaws are left undiscovered? Flaws in security, unlike other software flaws go noticed until an attacker has shed light upon it. Tomorrow might yield a entirely new attack pattern, and in this new light we find that all of the software that we use is horribly insecure.

... and this has already happened. Aleph one and buffer overflows, finding out that some format string bugs can be exploited, dangling pointers, H.D Moore and DLL hijacking, oah and don't forget about [fill in your favorite attack here].

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.