After Cheap Discovery: From unknown to known-and-unfixed

Abstract

Automated vulnerability discovery has removed the scarcity of expert attention that protected most software. The response has concentrated on discovery and on repair, and both are becoming cheaper. This article argues that neither cost curve determines exposure. What determines it is remediation coverage at the release decision: the fraction of identified vulnerabilities fixed before a product ships, and the residue of known, assessed, unremediated flaws an organisation has decided to ship with. Four arguments follow. The residue is not a random sample of what was found, because triage sorts on cost and the expensive cases are architectural. The deferred backlog is itself a high-value artifact. Documented awareness alters an organisation's legal and market position, and produces an adverse selection that the price of software does not reflect. And no regulatory instrument reaching vendors triggers on internal knowledge - every one fires on exploitation observed by a third party - which leaves the distance between what a vendor knows and what it must disclose entirely at the vendor's discretion. CISA's Binding Operational Directive 26-04 is examined as the exception that shows what a solution requires: a regulator's reach over a decision is bounded by its visibility of the input to that decision, so a duty attaching to internal knowledge needs an independent record of that knowledge to attach to. Release coverage is not currently measured, and measuring it is the precondition for liability, insurance or procurement to act.