  As researchers, we already understand how to make testing more effective and
efficient at finding bugs. However, as fuzzing (i.e., automated testing)
becomes more widely adopted in practice, practitioners are asking: Which
assurances does a fuzzing campaign provide that exposes no bugs? When is it
safe to stop the fuzzer with a reasonable residual risk? How much longer should
the fuzzer be run to achieve sufficient coverage?
  It is time for us to move beyond the innovation of increasingly sophisticated
testing techniques, to build a body of knowledge around the explication and
quantification of the testing process, and to develop sound methodologies to
estimate and extrapolate these quantities with measurable accuracy. In our
vision of the future practitioners leverage a rich statistical toolset to
assess residual risk, to obtain statistical guarantees, and to analyze the
cost-benefit trade-off for ongoing fuzzing campaigns. We propose a general
framework as a first starting point to tackle this fundamental challenge and
discuss a large number of concrete opportunities for future research.
