Fuzzing is a convenient, relatively low-cost way to detect some kinds of vulnerabilities, particularly in C/C++ code.
My question: How much fuzzing is enough? Are there are any standards or best practices?
Example: Microsoft's SDL requires that applying fuzzing to security-sensitive code that parses file-based input. The SDL requires a minimum of 500,000 iterations of fuzz testing, and at least 250,000 "clean" iterations. (Here's a citation. Any fuzz iteration that finds a security bug resets the count of "clean" iterations back to zero.) The SDL also requires that all network data be fuzzed for at least 100,000 iterations. (Here's a citation.)
Does anyone know of other guidelines, or the criteria that other organizations use?