Answers are grounded in this paper and cite their sources.
Software is the biggest problem in computer security today. Most organizations invest in security by buying and maintaining a firewall, but they go on to let anybody access multiple Internet-enabled applications through that firewall. These applications are often remotely exploitable, rendering the firewall impotent (not to mention the fact that the firewall is often a piece of fallible software itself). Real attackers exploit software.
No takes yet. Share an insight, caveat, or question.
Gary McGraw (2002) studied this question.
Synapse has enriched 10 related papers. Consider them for comparative context: