  Vulnerability management strategy, from both organizational and public policy
perspectives, hinges on an understanding of the supply of undiscovered
vulnerabilities. If the number of undiscovered vulnerabilities is small enough,
then a reasonable investment strategy would be to focus on finding and removing
the remaining undiscovered vulnerabilities. If the number of undiscovered
vulnerabilities is and will continue to be large, then a better investment
strategy would be to focus on quick patch dissemination and engineering
resilient systems. This paper examines a paradigm, namely that the number of
undiscovered vulnerabilities is manageably small, through the lens of
mathematical concepts from the theory of computing. From this perspective, we
find little support for the paradigm of limited undiscovered vulnerabilities.
We then briefly support the notion that these theory-based conclusions are
relevant to practical computers in use today. We find no reason to believe
undiscovered vulnerabilities are not essentially unlimited in practice and we
examine the possible economic impacts should this be the case. Based on our
analysis, we recommend vulnerability management strategy adopts an approach
favoring quick patch dissemination and engineering resilient systems, while
continuing good software engineering practices to reduce (but never eliminate)
vulnerabilities in information systems.
