Incorporating cost into appsec metrics for organisations

The document critiques common application security metrics that rely on vulnerability counts (e.g., DBIR, SOSS, WhiteHat, WASC) for lacking resolution and failing to account for attacker effort, and proposes a base metric of findings-per-day (or days-per-finding) to approximate attacker cost for improved decision-making, trend analysis, and peer comparisons. It acknowledges limitations (tester skill variance, differing app functionality, minimum sample sizes), suggests enriching data with contextual attributes (e.g., outsourcing, SDLC model, tech stack), and shares positive feedback from a client field test indicating the approach can support practical security decisions.