Textual analysis of security bug reports

SIR alone appears to explain the bulk of the correlation between Incident Responder ratings and the Risk Index model. However, it appears that the semantic quality factor, Q, was able to capture some risk information that SIR alone was not. While the random variation in Spearman's Correlation Coefficient calculated on a sample of 20 observations is significant compared to any of the absolute differences observed between Risk Index and Risk Index Plus correlations with IRs, several of the differences, approach the magnitude of one standard deviation. There is also a consistent pattern in that each of the seven IRs' correlations were higher with Risk Index Plus compared to the baseline Risk Index.