Answers are grounded in this paper and cite their sources.
Software is the biggest problem in computer security today. Most organizations invest in security by buying and maintaining a firewall, but they go on to let anybody access multiple Internet-enabled applications through that firewall. These applications are often remotely exploitable, rendering the firewall impotent (not to mention the fact that the firewall is often a piece of fallible software itself). Real attackers exploit software.
No takes yet. Share an insight, caveat, or question.
Gary McGraw (2002) studied this question.
Synapse has enriched 5 related papers. Consider them for comparative context: