Out of the following which one is not a software security metric
Vulnerabilities detected on xyz server
Effort slippage
Number of non negligible risks in the application
Total exceptions not handled correctly