Web App Sec ROI

[Mark Curphey <mark () curphey com>]

In the same light as the Web App Sec Top Ten, does anyone know about any
good studies or want to share their thoughts about the ROI of getting
Web App Sec right in development ?

How much does it cost to fix a typical problem like XSS or SQL Injection
?

How much does it cost each company for each incident (I see $16K for a
virus incident used often)?

How much does it cost to do a secure code review of a web app before
release ?


etc, etc


-- 
Mark Curphey <mark () curphey com>