Original title: After Cheap Discovery: From unknown to known-and-unfixed
Bahman Sistany · September 2026
Computers can now scan software for security bugs automatically. Finding and fixing these flaws has become cheap. Yet software remains vulnerable. The author looked at why this happens and found that lower costs do not decide how safe a product is. Instead, safety depends on release coverage. This is the share of discovered bugs a company actually fixes before sending software to users. When companies sort through bugs, they leave behind the flaws that cost the most to repair, which are often deep design flaws. This list of ignored bugs is valuable to attackers. Knowing about these bugs changes a company's legal standing and causes market problems that prices do not show. Current regulations only act when an outsider spots an attack, letting companies hide what they know until they measure release coverage.
Imagine running a restaurant where health inspections find kitchen problems. Instead of fixing everything before opening, you decide to serve food with some known issues, like a leaky faucet. The customers don't know about these flaws, and inspectors only show up after someone gets sick. In this paper, the residue of known vulnerabilities is like serving food with known issues; the focus is on what you leave unfixed at opening time, not what you found and fixed.
Organizations shipping software with known flaws face legal and market risks not reflected in prices. Regulations only act after exploitation, leaving vendors to decide disclosure.
The abstract doesn't specify how remediation coverage should be measured or provide evidence that measuring it will enable liability, insurance, or procurement actions. It presents arguments and an example but not empirical validation or implementation details.
Ask anything about this paper. Answers come from its abstract, and say so when the abstract doesn't cover your question.
After Cheap Discovery: From unknown to known-and-unfixed — Bahman Sistany
Abstract licence: CC0
Explanation generated by Synthesis from the abstract — it is not the original paper. This is a preprint, so it hasn't necessarily been peer reviewed.