The later you find it, the more it costs — roughly exponential, from x1 in requirements to hundreds of times more in operations.

The cost climbs because a late-discovered flaw has already been built into design decisions, code, tests, documentation and live data — all of which must be unwound and re-verified:

Key takeaway: Fix security issues early - it's much cheaper to address them during requirements than in production.

Software Assurance is confidence that software is free of vulnerabilities and behaves as intended — its two pillars are Trustworthiness and Predictable Execution.

Software Assurance (SwA) is the level of confidence that software is free from vulnerabilities — whether intentionally designed in (a backdoor) or accidentally inserted at any point in its lifecycle — and that it functions in the intended manner.

The two properties are deliberately split because they fail in different ways:

1. Trustworthiness: no weaknesses an attacker (or accident) can exploit. This is the security half — it's about the absence of bad behaviour.
2. Predictable Execution: when you run it, it does exactly what it's supposed to. This is the correctness half — it's about the presence of good behaviour.

Tip: Trustworthy-but-unpredictable (secure yet buggy) and predictable-but-untrustworthy (works perfectly but has a backdoor) are both assurance failures — you need both halves.