That's honest. :) I agree it will be around a while thanks to all the incumbent code. It's why I push for efforts to automatically deal with its issues at least for legacy code. Astree Analyzer, Softbound + CETS, CHERI processor, and CompCert compiler are all top examples of that. Links below. Enjoy. :)

http://www.absint.com/astree/index.htm

http://www.cs.rutgers.edu/~santosh.nagarakatte/softbound/

https://www.cl.cam.ac.uk/research/security/ctsrd/pdfs/201503...

http://compcert.inria.fr/