However, the the calculation of $4000 per vulnerability is valid for applications only: The fix has to be applied on the few server sites, and he is it.However, even today not all software is web application software.On the other end of the spectrum there is software like e.g. Internet Explorer or Adobe Reader.