Answers are grounded in this paper and cite their sources.
Security bugs' hidden nature is why we need specific, focused application-security testing techniques, testing that defies the traditional model of verifying an application's specification and instead identifies the unspecified and insecure side-effects of "correct" application functionality. I examine application penetration testing - software testing that's specifically designed to hunt down security vulnerabilities
No takes yet. Share an insight, caveat, or question.
Herbert H. Thompson (2005) studied this question.
Synapse has enriched 10 related papers. Consider them for comparative context: