Trends, challenges, and strategic shifts in the software vulnerability mitigation landscape
https://github.com/microsoft/MSRC-Security-Research
Method
"Note: CVEs may have multiple root causes, so they can be counted in multiple categories"
Population
"Today we'll be focusing on Microsoft RCE, EOP, and ID vulnerabilities (CVEs) addressed via a software update"
What it does not show
Purely descriptive with no causal claim. Scoped to remote-code-execution, elevation-of-privilege and information-disclosure CVEs fixed by a security update — not all reported vulnerabilities and not all of the organisation’s code. Says nothing about the split between newly written and legacy code.
Matt Miller, Microsoft Security Response Center
About 70% of the vulnerabilities addressed through a security update each year continue to be memory-safety issues, across patch years 2006 to 2018. The leading root causes since 2016 are heap out-of-bounds access, use-after-free, type confusion and uninitialised use.
Tier II: Descriptive trend analysis over a decade of one organisation’s assigned CVEs. Real production data at scale, no comparison group.