Static software security testing typically uses __________ as a measure of how thorough the testing was.

The number of testers does not directly measure the thoroughness of static code analysis; automated tools are often used for SAST.

While flaws detected is an outcome of testing, it doesn't directly measure the *thoroughness* of the test *process* itself, as thoroughness refers to how much of the code was examined.

Static Application Security Testing (SAST) analyzes source code without executing it, and 'code coverage' measures the percentage of the codebase that has been examined by the testing tools, indicating the thoroughness of the static analysis. High code coverage ensures that a significant portion of the application's logic has been scanned for potential vulnerabilities.

Malware hits are relevant to dynamic analysis or runtime protection, not typically a direct measure for static software security testing, which focuses on identifying vulnerabilities in the code itself.