> vulnerabilities decay exponentially This should be true not just of vulnerabilities, but bugs of any kind. I certainly see this in testing of the free softw

> vulnerabilities decay exponentially This should be true not just of vulnerabilities, but bugs of any kind. I certainly see this in testing of the free software project I'm involved with (SBCL). New bugs tend to be in parts that have been recently changed. I'm sure you all have seen the same sort of effect. (This is not to say all bugs are in recent code. We've all seen bugs that persist undetected for years. The question for those should be how did testing miss them.) So this suggests testing should be focused on recently changed code. In particular, mutation testing can be highly focused on such code, or on code closely coupled with the changed code. This would greatly reduce the overhead of applying this testing. Google has had a system where mutation testing has been used with code reviews that does just this.