Pontus Johnson, Dan Gorton, Robert Lagerström, Mathias Ekstedt: Time between vulnerability disclosures: A measure of software product vulnerability. Comput. Secur. 62: 278-295 (2016)