The field of software security is moving towards a more nuanced understanding of the relationship between security practices and outcomes. Recent studies have highlighted the importance of prioritizing security practices based on empirical evidence, and have investigated the impact of individual security practices on security outcomes such as vulnerability count and remediation time. Time series analysis has also been applied to examine the longitudinal aspects of software ecosystem security, including the frequency and prediction of malware uploads. Furthermore, research has begun to explore the concept of 'aging debt' in software, which refers to the increased maintenance efforts and costs needed to keep software updated, and has proposed a taxonomy for categorizing temporal software aging. Noteworthy papers include:

• Prioritizing Security Practice Adoption, which found that higher aggregated security practice scores are associated with fewer vulnerabilities and shorter times to update dependencies.
• Wolves in the Repository, which examined a sophisticated supply chain attack on the XZ Utils project and demonstrated how attackers can manipulate software engineering practices to establish legitimacy and maintain long-term control.