{"id":"https://openalex.org/W7208738210","doi":"https://doi.org/10.48550/arxiv.2609.03266","title":"After Cheap Discovery: From unknown to known-and-unfixed","display_name":"After Cheap Discovery: From unknown to known-and-unfixed","publication_year":2026,"publication_date":"2026-09-03","ids":{"openalex":"https://openalex.org/W7208738210","doi":"https://doi.org/10.48550/arxiv.2609.03266"},"language":"en","primary_location":{"id":"pmh:oai:arXiv.org:2609.03266","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2609.03266","pdf_url":"https://arxiv.org/pdf/2609.03266","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"volume":null,"type":"preprint","is_traditional":true,"indexed_in":["arxiv","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2609.03266","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5015685156","display_name":"Bahman Sistany","orcid":"https://orcid.org/0009-0006-4791-7416","observed_orcids":["https://orcid.org/0009-0006-4791-7416"]},"institutions":[],"countries":[],"is_corresponding":true,"raw_author_name":"Sistany, Bahman","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":["https://openalex.org/A5015685156"],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":1,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.4546000063419342,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.4546000063419342,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.42899999022483826,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T13364","display_name":"Digitalization, Law, and Regulation","score":0.035599999129772186,"subfield":{"id":"https://openalex.org/subfields/3308","display_name":"Law"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/release-decisions","display_name":"release decisions","score":0.5630000233650208},{"id":"https://openalex.org/keywords/software-security","display_name":"software security","score":0.35600000619888306},{"id":"https://openalex.org/keywords/regulatory-disclosure","display_name":"regulatory disclosure","score":0.4300000071525574},{"id":"https://openalex.org/keywords/adverse-selection","display_name":"adverse selection","score":0.5929999947547913},{"id":"https://openalex.org/keywords/software-liability","display_name":"software liability","score":0.4429999887943268},{"id":"https://openalex.org/keywords/software-procurement","display_name":"software acquisition","score":0.40700000524520874},{"id":"https://openalex.org/keywords/vulnerability-triage","display_name":"vulnerability triage","score":0.6010000109672546}],"concepts":[{"id":"https://openalex.org/C201650216","wikidata":"https://www.wikidata.org/wiki/Q829492","display_name":"Procurement","level":2,"score":0.5098999738693237},{"id":"https://openalex.org/C2779547435","wikidata":"https://www.wikidata.org/wiki/Q1121492","display_name":"Directive","level":2,"score":0.492900013923645},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.490200012922287},{"id":"https://openalex.org/C109747225","wikidata":"https://www.wikidata.org/wiki/Q815758","display_name":"Scarcity","level":2,"score":0.4810999929904938},{"id":"https://openalex.org/C2777338717","wikidata":"https://www.wikidata.org/wiki/Q1762621","display_name":"Vendor","level":2,"score":0.48089998960494995},{"id":"https://openalex.org/C90673727","wikidata":"https://www.wikidata.org/wiki/Q901718","display_name":"Product (mathematics)","level":2,"score":0.4465000033378601},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.43650001287460327},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.40689998865127563},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.3391000032424927},{"id":"https://openalex.org/C32252159","wikidata":"https://www.wikidata.org/wiki/Q380037","display_name":"Adverse selection","level":2,"score":0.31779998540878296},{"id":"https://openalex.org/C42475967","wikidata":"https://www.wikidata.org/wiki/Q194292","display_name":"Operations research","level":1,"score":0.31769999861717224},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.3163999915122986},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.3001999855041504},{"id":"https://openalex.org/C198531522","wikidata":"https://www.wikidata.org/wiki/Q485146","display_name":"Sample (material)","level":2,"score":0.2973000109195709},{"id":"https://openalex.org/C162118730","wikidata":"https://www.wikidata.org/wiki/Q1128453","display_name":"Actuarial science","level":1,"score":0.2815999984741211},{"id":"https://openalex.org/C32896092","wikidata":"https://www.wikidata.org/wiki/Q189447","display_name":"Risk management","level":2,"score":0.28139999508857727},{"id":"https://openalex.org/C162324750","wikidata":"https://www.wikidata.org/wiki/Q8134","display_name":"Economics","level":0,"score":0.28060001134872437},{"id":"https://openalex.org/C21547014","wikidata":"https://www.wikidata.org/wiki/Q1423657","display_name":"Operations management","level":1,"score":0.2784999907016754},{"id":"https://openalex.org/C134697681","wikidata":"https://www.wikidata.org/wiki/Q1609677","display_name":"Clearing","level":2,"score":0.2784999907016754},{"id":"https://openalex.org/C46934059","wikidata":"https://www.wikidata.org/wiki/Q61515","display_name":"Outsourcing","level":2,"score":0.2630999982357025},{"id":"https://openalex.org/C206345919","wikidata":"https://www.wikidata.org/wiki/Q20380951","display_name":"Resource (disambiguation)","level":2,"score":0.2615000009536743},{"id":"https://openalex.org/C72161134","wikidata":"https://www.wikidata.org/wiki/Q5421219","display_name":"Expert elicitation","level":2,"score":0.2565999925136566}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:oai:arXiv.org:2609.03266","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2609.03266","pdf_url":"https://arxiv.org/pdf/2609.03266","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.48550/arxiv.2609.03266","doi":"https://doi.org/10.48550/arxiv.2609.03266","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2609.03266","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2609.03266","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2609.03266","pdf_url":"https://arxiv.org/pdf/2609.03266","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","score":0.4399999976158142,"display_name":"Peace, justice, and strong institutions"}],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7208738210.pdf","grobid_xml":"https://content.openalex.org/works/W7208738210.grobid-xml"},"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W7204245656","https://openalex.org/W2892212057","https://openalex.org/W2162373348","https://openalex.org/W2981249100","https://openalex.org/W1887622249","https://openalex.org/W1527783302","https://openalex.org/W2231349224","https://openalex.org/W2184923175","https://openalex.org/W2089315407","https://openalex.org/W7095824465"],"abstract_inverted_index":{"Automated":[0],"vulnerability":[1],"discovery":[2,19],"has":[3,16,67],"removed":[4],"the":[5,44,47,58,92,120,151,165,176,196,228],"scarcity":[6],"of":[7,49,60,82,122,195,212],"expert":[8],"attention":[9],"that":[10,31,119,178,199,213],"protected":[11],"most":[12],"software.":[13],"The":[14,75,97],"response":[15],"concentrated":[17],"on":[18,21,89,134,141],"and":[20,23,57,91,111,114,158,224],"repair,":[22],"both":[24],"are":[25,95],"becoming":[26],"cheaper.":[27],"This":[28],"article":[29],"argues":[30],"neither":[32],"cost":[33,90],"curve":[34],"determines":[35,38],"exposure.":[36],"What":[37],"it":[39,160,226],"is":[40,77,100,173,190,220,227],"remediation":[41],"coverage":[42,219],"at":[43,164],"release":[45],"decision:":[46],"fraction":[48],"identified":[50],"vulnerabilities":[51],"fixed":[52],"before":[53],"a":[54,79,102,145,155,181,184,188,202],"product":[55],"ships,":[56],"residue":[59,76],"known,":[61],"assessed,":[62],"unremediated":[63],"flaws":[64],"an":[65,108,116,209],"organisation":[66],"decided":[68],"to":[69,198,205,215,235],"ship":[70],"with.":[71],"Four":[72],"arguments":[73],"follow.":[74],"not":[78,125,221],"random":[80],"sample":[81],"what":[83,154,159,180],"was":[84],"found,":[85],"because":[86],"triage":[87],"sorts":[88],"expensive":[93],"cases":[94],"architectural.":[96],"deferred":[98],"backlog":[99],"itself":[101],"high-value":[103],"artifact.":[104],"Documented":[105],"awareness":[106],"alters":[107],"organisation's":[109],"legal":[110],"market":[112],"position,":[113],"produces":[115],"adverse":[117],"selection":[118],"price":[121],"software":[123],"does":[124],"reflect.":[126],"And":[127],"no":[128],"regulatory":[129],"instrument":[130],"reaching":[131],"vendors":[132],"triggers":[133],"internal":[135,206],"knowledge":[136,207,214],"-":[137,148],"every":[138],"one":[139],"fires":[140],"exploitation":[142],"observed":[143],"by":[144,192],"third":[146],"party":[147],"which":[149],"leaves":[150],"distance":[152],"between":[153],"vendor":[156],"knows":[157],"must":[161],"disclose":[162],"entirely":[163],"vendor's":[166],"discretion.":[167],"CISA's":[168],"Binding":[169],"Operational":[170],"Directive":[171],"26-04":[172],"examined":[174],"as":[175],"exception":[177],"shows":[179],"solution":[182],"requires:":[183],"regulator's":[185],"reach":[186],"over":[187],"decision":[189],"bounded":[191],"its":[193],"visibility":[194],"input":[197],"decision,":[200],"so":[201],"duty":[203],"attaching":[204],"needs":[208],"independent":[210],"record":[211],"attach":[216],"to.":[217],"Release":[218],"currently":[222],"measured,":[223],"measuring":[225],"precondition":[229],"for":[230],"liability,":[231],"insurance":[232],"or":[233],"procurement":[234],"act.":[236]},"counts_by_year":[{"year":2026,"cited_by_count":1}],"updated_date":"2026-11-04T10:54:05.112534","created_date":"2026-09-05T00:00:00"}