It can be partially observed by looking at the amount people in-the-know (the developers, insurance underwriters, auditors, ...) are willing to bet on the security.