What Does a Bug Actually Cost?

The conventional metrics for measuring autonomous pentesting are exploitability (rewarding a system for constructing a working exploit) and coverage (finding as many bug types as possible). But this does not reflect real world resource-constrained product security where you need to look at the cost and human triage effort required to validate, prioritize, and remediate bugs.