Regulation reaching software vendors fires on third-party exploitation, never on internal knowledge.

arXiv 2609.03266 argues that with discovery and repair both getting cheaper, exposure is set by remediation coverage at the release decision, meaning the fraction of identified vulnerabilities fixed before shipping and the residue of known, assessed, unremediated flaws. That residue isn't a random sample of what was found, because triage sorts on cost and the expensive cases are architectural. Documented awareness alters legal and market position while producing adverse selection that software pricing doesn't reflect. CISA's Binding Operational Directive 26-04 is examined as the exception (arXiv).