You cannot improve what you do not measure: A triangulation study of software security metrics.

Arina Kudriavtseva, Olga Gadyatskaya

Browse the full SAC paper archive.