FTA: "...the oldest applications in our sample...have likely undergone more extensive remediation for security vulnerabilities over time..." I suspect the age

FTA: "...the oldest applications in our sample...have likely undergone more extensive remediation for security vulnerabilities over time..." I suspect the age of the codebase correlates better with their metrics than the implementation language. The worst-performing languages are also the ones with the most recent code. They're not finding a Java problem or a .NET problem, they're finding problems in fresh code, which is no surprise.