## 3 Results
### Experiments for the Commonly Used IoT Technologies
\begin{table}
\begin{tabular}{c c c c c c c} \hline
**Security** & **\# Issues** & **Consumed** & **Impact** & **\% of Total Budget** & **\% Issues** & **\% Impact** \\
**Budget** & **Mitigated** & **Budget** & **Mitigated** & **Available** & **Mitigated** & **Mitigated** \\ \hline
50 & 8 & 47 & 58.95 & 5.17\% & 17.02\% & 21.57\% \\
125 & 15 & 122 & 98.25 & 12.93\% & 12.62\% & 35.94\% \\
250 & 23 & 247 & 144.13 & 25.85\% & 48.94\% & 52.73\% \\
500 & 33 & 497 & 210.52 & 51.71\% & 70.21\% & 77.02\% \\ \hline \end{tabular}
\end{table} 
Table 2: Results of applying the security issue prioritization to the commonly used IoT technologies’ configuration. The results in Table 2 demonstrate that especially when the security budget is very limited, the scarce resources can be efficiently allocated to the mitigation of security issues with a very high impact, which is testified by the fact that for the case of having a security budget equal to 50, the ratio of the mitigated impact percentage is 21.57%, approximately 4 times higher than the percentage of the available budget. When the available security budget increases, this performance margin narrows, declining to the value of approximately 1.5 times higher when the security budget is equal to 500 (or 51.71% of the total available budget). Figure 2 depicts the effectiveness of the proposed approach against the baseline algorithms concerning the configuration including the commonly used IoT technologies. We can observe that under all security budgets, the proposed approach achieves the highest percentage of the mitigated impact, with a margin ranging from 0.51% to 23.14% against the runner-up (which is the \(IMM_{ST}\) algorithm in all cases) when comparing absolute magnitudes (i.e., \(impactMitigated(proposed)-impactMitigated(baseline))\); when considering relative improvements (i.e., \(\frac{impactMitigated(proposed)-impactMitigated(baseline)}{impactMitigated(baseline)}\)), the effectiveness margin of the proposed algorithm ranges from 0.87% to 12.35%. When the security budget is very small (50, i.e., approximately 5% of the total technical debt), the performance edge of the proposed algorithm is small (relative improvement equal to 0.87%), due to the fact that many vulnerabilities with small fix times with \"blocker\" and \"critical\" characterizations have high impacts; hence the \(IMM_{ST}\) algorithm is circumstantially led to \"close to optimal\" decisions, due to the combined distribution of the impact, criticality level, and technical debt of the software vulnerability dataset. This distribution is depicted in Figure 3; in this figure, we can partition vulnerabilities into four quartiles, with Q1 including vulnerabilities with a low cost to fix and their remediation results to high gains in the residual risk of the overall configuration. The presence of numerous \"blocker\" and \"critical\" vulnerabilities in this quartile is the reason that leads to the \"close to optimal\" performance of the \(IMM_{ST}\) for the constrained security budget. \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Security** & **\# Issues** & **Consumed** & **Impact** & **\% of Total Budget** & **\% Issues** & **\% Impact** \\
**Budget** & **Mitigated** & **Budget** & **Mitigated** & **Available** & **Mitigated** & **Mitigated** \\ \hline
250 & 13 & 245 & 107.46 & 8.63\% & 13\% & 14.88\% \\
500 & 22 & 500 & 185.899 & 17.61\% & 22\% & 25.74\% \\
1000 & 38 & 980 & 308.05 & 34.51\% & 38\% & 42.65\% \\
1500 & 55 & 1490 & 437.78 & 52.46\% & 55\% & 60.61\% \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Results of applying the security issue prioritization to the SOHO configuration. Figure 2: Effectiveness of security issue fix prioritization algorithms for the commonly used IoT technologies’ configuration. The margin between the proposed approach and other algorithms is larger, ranging from 2.72% to 32.40% in absolute magnitudes, while the corresponding relative improvement ranges from 4.84% to 496.18%.