Exploit mitigation may be all that stops a vulnerability being successfully exploited. Here are some excellent slides on exploit mitigation in general: https:/

Exploit mitigation may be all that stops a vulnerability being successfully exploited. Here are some excellent slides on exploit mitigation in general: https://events.yandex.com/events/ruBSD/2013/talks/103/ https://events.yandex.com/events/ruBSD/2013/talks/103/ Of the top of my head there are four approaches to stopping memory vulnerabilities: 1) have no bugs, e.g. formal verification etc 2) use a memory-safe language 3) accept that there can be vulnerabilities, and use exploit mitigation to harden it 4) capability-based addressing as a mitigation (it doesn't solve use-after-free, for example; it relies on software to do that etc) Of these, (3) is the one you can retrofit to existing C/C++ codebases... a route you are usually forced to travel. (There may still be other kinds of bugs, e.g. the obvious sql injections etc; I am talking above about memory bugs specifically)