Abstract: A methodology of evaluating computer security vulnerabilities in computer products for domain-specific characteristics, statistical trends, and innovative mitigation strategies is presented. The methodology can be programmed into a computer system. Raw security vulnerability data pertaining to a computer product to be analyzed is culled from a pool of trusted resources. Redundant data is combined into separate mutually exclusive records and parsed using a hierarchical taxonomy of security characteristics and security analysis terms. The taxonomy serves to harmonize disparate terminology through the use of canonical terms that equate multiple synonymous terms with the canonical term. The taxonomy also serves to categorize the vulnerability according to a hierarchy of categories and sub-categories so that it may be logically processed and presented to an analyst.