This is a pretty silly analysis.<p>C is categorically less secure than Java.<p>Almost every &quot;rule&quot; SEI CERT has for Java either applies directly to C, or is mooted by C&#x27;s fundamental insecurity.<p>For an instance of the former case, take SQL Injection: SEI CERT dings Java because it provides libraries that enable SQL injection. C doesn&#x27;t provide any such libraries --- because it doesn&#x27;t provide SQL libraries at all! But rest assured that if you bring SQL into your C application through, for instance, the SQLite library, you&#x27;re inheriting the same set of concerns.<p>For an example of the latter case, take the Java &quot;privilege&quot; system. SEI CERT dings Java because operating the Java privilege system is fiddly, and if you do it wrong you&#x27;re exposed to privilege escalation. You&#x27;re not exposed to privilege escalation in C --- because all C code is privileged!<p>This is about the level of pointy-haired boss analysis that I&#x27;ve come to expect from CERT.