# Vulnerability Detection is Just the Beginning

**Authors:** Sarah Elder  
**arXiv:** [2103.05160](https://arxiv.org/abs/2103.05160)  
**Date:** 2021-03-09  
**Summary page:** https://www.summarizepaper.com/en/arxiv-id/2103.05160v1/

## Key points

- Vulnerability detection plays a crucial role in secure software development
- Insufficient information on which vulnerability detection tools and techniques to use
- Research by Sarah Elder aims to provide guidance to managers and decision-makers on software projects
- Analysis of efficiency and effectiveness of different vulnerability detection techniques
- Focus on relationships between technique employed, type of vulnerability identified, exploitability, and effort required to fix it
- Study conducted on two specific projects with successfully resolved vulnerabilities
- Valuable insights gained regarding most effective techniques for detecting specific vulnerabilities and their exploitability
- Scope extends to encompass Open Source Software (OSS) projects
- Exploration of various vulnerability detection techniques used in OSS projects and impact of resource constraints on vulnerability resolution
- Research aims to assist software project managers and decision-makers in selecting appropriate vulnerability detection techniques
- Empirical analysis and observations from OSS will provide valuable insights into improving secure software development practices.

## Summary

In the field of secure software development, vulnerability detection plays a crucial role. With numerous vulnerability detection tools and techniques available, there is often insufficient information on which ones to use and when. To address this issue, the research conducted by Sarah Elder aims to provide guidance to managers and decision-makers on software projects by analyzing the efficiency and effectiveness of different vulnerability detection techniques. The study focuses on examining the relationships between the technique employed, the type of vulnerability identified, its exploitability and effort required to fix it. This analysis will be carried out on two specific projects where all identified vulnerabilities have been successfully resolved. By studying these relationships in detail, valuable insights can be gained regarding which techniques are most effective in detecting specific types of vulnerabilities and how easily they can be exploited. Furthermore, the research extends its scope to encompass Open Source Software (OSS) more broadly. In OSS projects, practitioners may employ various vulnerability detection techniques or face resource constraints that prevent them from addressing all identified vulnerabilities. By exploring these scenarios within OSS projects, a broader understanding of how different techniques are utilized and how resource limitations impact vulnerability resolution can be obtained. Overall, this research endeavors to assist software project managers and decision-makers in making informed choices about selecting appropriate software vulnerability detection techniques. The empirical analysis conducted on specific projects as well as observations from OSS will provide valuable insights into improving secure software development practices.