Strange question: is it statistically more likely for a major security vulnerability to be found in a piece of software given one has already discovered a vulnerability, or is the probability of the presence of a major vulnerability independent of how many vulnerabilities have been previously discovered?

My kneejerk reaction is to say it is more likely (just look at ), but that's very much anecdotal. I'm wondering if anyone has ever done any formal academic research into this, as if there is a statistical correlation, then wouldn't that help inform things like maintenance budgets & such?

  • it will depend more on the cause of the known vulnerability than the mere existence of one – schroeder Nov 30 '17 at 17:57
  • I think this depends on the kind of bugs: the existence of easy to find bugs is probably caused by bad development practices (inexperienced developers, lack of quality control, ...), which means that the chance of finding more bugs is high. But I don't think one can draw the same conclusion for hard to find bugs. – Steffen Ullrich Nov 30 '17 at 18:07
  • I'd suggest that the probability of bugs is more related to the age and complexity of the code than to its list of previously discovered bugs. For instance, a VB script that just calls a messagebox won't likely have any bugs, whereas Windows 10 or a new distro of Linux will and most likely will for a long time to come. – baldPrussian Nov 30 '17 at 19:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.