You might need to reframe your terminology on what "software fragility" is referring to. If you mean looking into critical failures in systems due to vulnerabil

You might need to reframe your terminology on what "software fragility" is referring to. If you mean looking into critical failures in systems due to vulnerabilities in third-party libraries (I'm thinking Log4JS), then the terminology currently used in security is "software supply chain" [1]. My general process is once you've found an article, like the "Backstabber's knife collection: A review of open source software supply chain attacks" from my link, read through it with a text editor open. Make notes like a summary of what they did, what they found, strengths and weaknesses, and what I like to call "the rabbit hole". If you see a reference to something you're curious about, find what the citation for that piece of information is and follow up with a reading of that article next. Repeat until you've exhausted the findings and move on to the next interesting reference. [1] https://scholar.google.com/scholar?as_ylo=2019&q=software+supply+chain&hl=en&as_sdt=0,34 https://scholar.google.com/scholar?as_ylo=2019&q=software+su...