> I’d love to see a running tally of the cost of buffer overflows.

It's probably a lot lower than the cost of never implementing the software in the first place.