The Microsoft Security Blog provides in-depth discussion of security, cybersecurity and technology trends affecting trust in computing, as well as timely security news, trends, and practical security guidance.
Read more about the Microsoft Security Blog contributors>
I thought I had posted this link in the past, but it turns out I did not, so ...
Last summer (2007), one of my papers was published in IEEE Security & Privacy, which describes a method for estimating the number of disclosed but unfixed vulnerabilities in some version of software utilizing publicly available data.
The citation reference is:
Jeffrey R. Jones, "Estimating Software Vulnerabilities," IEEE Security & Privacy, vol. 5, no. 4, 2007, pp. 28-32.
IEEE kindly made the paper available online and as a downloadable document here.