[ { "slug": "cisco", "name": "Cisco", "categories": [ "edge", "infrastructure" ], "grade": "A-", "score": 89.6, "scoreInterval": [ 83.4, 95.8 ], "confidence": "medium", "provisional": false, "provisionalReason": null, "rank": 1, "privateFix": { "grade": "B-", "score": 73.4, "scoreInterval": [ 66.9, 79.8 ], "confidence": "medium", "provisional": false, "provisionalReason": null, "rank": 6, "n": 15 }, "trend": "flat", "responseN": 14, "subScores": [ { "key": "speed", "label": "Private fix speed", "score": 73.4, "grade": "B-", "weight": 1.0, "n": 15, "confidence": "medium", "headlineStat": "Median 113 days from private report to fix (15 cases, 8 with a vendor fix date)", "group": "privateFix" }, { "key": "silence", "label": "Time to first advisory", "score": 92.8, "grade": "A", "weight": 0.2, "n": 14, "confidence": "high", "headlineStat": "14 of 14 zero-days within a day", "group": "response" }, { "key": "exposure", "label": "Time to first fix", "score": 87.8, "grade": "A-", "weight": 0.4, "n": 14, "confidence": "medium", "headlineStat": "12 of 14 zero-days within a day, longest 29 days", "group": "response" }, { "key": "followThrough", "label": "Time to fix all versions", "score": 88.7, "grade": "A-", "weight": 0.3, "n": 12, "confidence": "medium", "headlineStat": "8 of 12 zero-days within a day, longest 29 days", "group": "response" }, { "key": "trackRecord", "label": "Exploited-bug burden", "score": 15.1, "grade": "F", "weight": 0.0, "n": 33, "confidence": "high", "headlineStat": "20 KEV listings in 12 months, 29 in 24 months, 2 linked to ransomware", "group": "context" }, { "key": "openness", "label": "Openness", "score": 93.4, "grade": "A", "weight": 0.1, "n": 23, "confidence": "high", "headlineStat": "Advisories published as CSAF. 14 of 14 zero-days with a dated revision history. 13 of 13 advisories said the bug was exploited. 12 of 14 fixed zero-days with a public fix date for every version. 2 of 2 zero-days not fixed within a day had an advisory or mitigation within 72 hours.", "group": "response" } ], "stats": { "kev12mo": 20, "kev24mo": 29, "kevAllTime": 101, "ransomware24mo": 2, "incidents24mo": 25, "privateCases": 15, "medianPrivateFixDays": 113.0, "deadlineMissRate": 0.333, "unpatchedDisclosures": 0, "medianSilenceHours": 0.0, "medianExposureHours": 0.05, "medianFollowThroughHours": 0.08, "exploitedBeforePatchRate": 0.64, "liveUnpatched": 0 }, "medianStrip": { "vendor": 0.0, "workaround": 0.01, "patchFirst": 0.05, "patchAll": 0.08 }, "lastIncidentAt": "2026-10-14T15:55:00Z" }, { "slug": "sonicwall", "name": "SonicWall", "categories": [ "edge", "security" ], "grade": "B+", "score": 84.2, "scoreInterval": [ 74.9, 93.5 ], "confidence": "low", "provisional": true, "provisionalReason": "4 reviewed zero-days. Not enough yet for a firm grade", "rank": 2, "privateFix": { "grade": "B", "score": 78.2, "scoreInterval": [ 68.1, 88.3 ], "confidence": "low", "provisional": true, "provisionalReason": "7 private reports, published on 6 dates. Not enough yet for a firm grade", "rank": 5, "n": 7 }, "trend": null, "responseN": 4, "subScores": [ { "key": "speed", "label": "Private fix speed", "score": 78.2, "grade": "B", "weight": 1.0, "n": 7, "confidence": "low", "headlineStat": "Median 77 days from private report to fix (7 cases, 3 with a vendor fix date)", "group": "privateFix" }, { "key": "silence", "label": "Time to first advisory", "score": 84.9, "grade": "B+", "weight": 0.2, "n": 4, "confidence": "low", "headlineStat": "4 of 4 zero-days within a day", "group": "response" }, { "key": "exposure", "label": "Time to first fix", "score": 84.9, "grade": "B+", "weight": 0.4, "n": 4, "confidence": "low", "headlineStat": "4 of 4 zero-days within a day", "group": "response" }, { "key": "followThrough", "label": "Time to fix all versions", "score": 84.9, "grade": "B+", "weight": 0.3, "n": 4, "confidence": "low", "headlineStat": "4 of 4 zero-days within a day", "group": "response" }, { "key": "trackRecord", "label": "Exploited-bug burden", "score": 32.0, "grade": "F", "weight": 0.0, "n": 10, "confidence": "low", "headlineStat": "5 KEV listings in 12 months, 9 in 24 months, 4 linked to ransomware", "group": "context" }, { "key": "openness", "label": "Openness", "score": 77.6, "grade": "B", "weight": 0.1, "n": 7, "confidence": "medium", "headlineStat": "Advisories available by API and RSS. 4 of 4 zero-days with a dated revision history. 3 of 3 advisories said the bug was exploited. 4 of 4 fixed zero-days with a public fix date for every version.", "group": "response" } ], "stats": { "kev12mo": 5, "kev24mo": 9, "kevAllTime": 19, "ransomware24mo": 4, "incidents24mo": 7, "privateCases": 7, "medianPrivateFixDays": 77.0, "deadlineMissRate": 0.286, "unpatchedDisclosures": 0, "medianSilenceHours": 0.0, "medianExposureHours": 0.0, "medianFollowThroughHours": 0.0, "exploitedBeforePatchRate": 0.571, "liveUnpatched": 0 }, "medianStrip": { "vendor": 0.0, "workaround": 0.0, "patchFirst": 0.0, "patchAll": 0.0 }, "lastIncidentAt": "2026-09-01T05:43:57Z" }, { "slug": "citrix", "name": "Citrix", "categories": [ "edge" ], "grade": "B+", "score": 82.2, "scoreInterval": [ 72.9, 91.5 ], "confidence": "low", "provisional": true, "provisionalReason": "4 reviewed zero-days. Not enough yet for a firm grade", "rank": 3, "privateFix": { "grade": "NR", "score": null, "scoreInterval": null, "confidence": "none", "provisional": false, "provisionalReason": null, "rank": null, "n": 0 }, "trend": null, "responseN": 4, "subScores": [ { "key": "speed", "label": "Private fix speed", "score": null, "grade": "NR", "weight": 0.0, "n": 0, "confidence": "none", "headlineStat": "No private reports in the last 36 months", "group": "privateFix" }, { "key": "silence", "label": "Time to first advisory", "score": 84.4, "grade": "B+", "weight": 0.2, "n": 4, "confidence": "low", "headlineStat": "3 of 4 zero-days within a day, longest 25 hours", "group": "response" }, { "key": "exposure", "label": "Time to first fix", "score": 84.7, "grade": "B+", "weight": 0.4, "n": 4, "confidence": "low", "headlineStat": "2 of 4 zero-days within a day, longest 32 hours", "group": "response" }, { "key": "followThrough", "label": "Time to fix all versions", "score": 84.9, "grade": "B+", "weight": 0.3, "n": 4, "confidence": "low", "headlineStat": "2 of 4 zero-days within a day, longest 32 hours", "group": "response" }, { "key": "trackRecord", "label": "Exploited-bug burden", "score": 31.6, "grade": "F", "weight": 0.0, "n": 13, "confidence": "low", "headlineStat": "6 KEV listings in 12 months, 11 in 24 months, 1 linked to ransomware", "group": "context" }, { "key": "openness", "label": "Openness", "score": 59.3, "grade": "C-", "weight": 0.1, "n": 10, "confidence": "medium", "headlineStat": "No machine-readable advisory feed listed. 4 of 4 zero-days with a dated revision history. 3 of 3 advisories said the bug was exploited. 4 of 4 fixed zero-days with a public fix date for every version. 2 of 2 zero-days not fixed within a day had an advisory or mitigation within 72 hours.", "group": "response" } ], "stats": { "kev12mo": 6, "kev24mo": 11, "kevAllTime": 27, "ransomware24mo": 1, "incidents24mo": 9, "privateCases": 0, "medianPrivateFixDays": null, "deadlineMissRate": null, "unpatchedDisclosures": 0, "medianSilenceHours": 0.49, "medianExposureHours": 12.34, "medianFollowThroughHours": 12.34, "exploitedBeforePatchRate": 0.444, "liveUnpatched": 0 }, "medianStrip": { "vendor": 0.49, "workaround": null, "patchFirst": 12.33, "patchAll": 12.33 }, "lastIncidentAt": "2026-10-02T19:01:08Z" }, { "slug": "beyondtrust", "name": "BeyondTrust", "categories": [ "it-management", "security" ], "grade": "B+", "score": 80.9, "scoreInterval": [ 71.0, 90.8 ], "confidence": "low", "provisional": true, "provisionalReason": "4 reviewed zero-days. Not enough yet for a firm grade", "rank": 4, "privateFix": { "grade": "NR", "score": null, "scoreInterval": null, "confidence": "none", "provisional": false, "provisionalReason": null, "rank": null, "n": 0 }, "trend": null, "responseN": 4, "subScores": [ { "key": "speed", "label": "Private fix speed", "score": null, "grade": "NR", "weight": 0.0, "n": 0, "confidence": "none", "headlineStat": "No private reports in the last 36 months", "group": "privateFix" }, { "key": "silence", "label": "Time to first advisory", "score": 83.3, "grade": "B+", "weight": 0.2, "n": 4, "confidence": "low", "headlineStat": "4 of 4 zero-days within a day", "group": "response" }, { "key": "exposure", "label": "Time to first fix", "score": 84.1, "grade": "B+", "weight": 0.4, "n": 4, "confidence": "low", "headlineStat": "4 of 4 zero-days within a day", "group": "response" }, { "key": "followThrough", "label": "Time to fix all versions", "score": 84.1, "grade": "B+", "weight": 0.3, "n": 4, "confidence": "low", "headlineStat": "4 of 4 zero-days within a day", "group": "response" }, { "key": "trackRecord", "label": "Exploited-bug burden", "score": 57.5, "grade": "C-", "weight": 0.0, "n": 4, "confidence": "low", "headlineStat": "2 KEV listings in 12 months, 4 in 24 months, 1 linked to ransomware", "group": "context" }, { "key": "openness", "label": "Openness", "score": 53.7, "grade": "D+", "weight": 0.1, "n": 6, "confidence": "medium", "headlineStat": "No machine-readable advisory feed listed. 1 of 1 zero-day with a dated revision history. 2 of 2 advisories said the bug was exploited. 4 of 4 fixed zero-days with a public fix date for every version.", "group": "response" } ], "stats": { "kev12mo": 2, "kev24mo": 4, "kevAllTime": 4, "ransomware24mo": 1, "incidents24mo": 4, "privateCases": 0, "medianPrivateFixDays": null, "deadlineMissRate": null, "unpatchedDisclosures": 0, "medianSilenceHours": 0.0, "medianExposureHours": 0.0, "medianFollowThroughHours": 0.0, "exploitedBeforePatchRate": 1.0, "liveUnpatched": 0 }, "medianStrip": { "vendor": 0.0, "workaround": null, "patchFirst": 0.0, "patchAll": 0.0 }, "lastIncidentAt": "2026-10-15T00:00:00Z" }, { "slug": "ivanti", "name": "Ivanti", "categories": [ "edge", "it-management" ], "grade": "B+", "score": 81.6, "scoreInterval": [ 70.9, 92.3 ], "confidence": "low", "provisional": true, "provisionalReason": "4 reviewed zero-days. Not enough yet for a firm grade", "rank": 5, "privateFix": { "grade": "C", "score": 64.0, "scoreInterval": [ 52.6, 75.4 ], "confidence": "low", "provisional": true, "provisionalReason": "Wide range: 53–75", "rank": 19, "n": 41 }, "trend": null, "responseN": 4, "subScores": [ { "key": "speed", "label": "Private fix speed", "score": 64.0, "grade": "C", "weight": 1.0, "n": 41, "confidence": "low", "headlineStat": "Median 126 days from private report to ZDI's public advisory (41 cases, 4 published without a fix)", "group": "privateFix" }, { "key": "silence", "label": "Time to first advisory", "score": 83.0, "grade": "B+", "weight": 0.2, "n": 4, "confidence": "low", "headlineStat": "4 of 4 zero-days within a day", "group": "response" }, { "key": "exposure", "label": "Time to first fix", "score": 83.1, "grade": "B+", "weight": 0.4, "n": 4, "confidence": "low", "headlineStat": "4 of 4 zero-days within a day", "group": "response" }, { "key": "followThrough", "label": "Time to fix all versions", "score": 82.5, "grade": "B+", "weight": 0.3, "n": 3, "confidence": "low", "headlineStat": "3 of 3 zero-days within a day", "group": "response" }, { "key": "trackRecord", "label": "Exploited-bug burden", "score": 26.8, "grade": "F", "weight": 0.0, "n": 24, "confidence": "medium", "headlineStat": "6 KEV listings in 12 months, 13 in 24 months, 2 linked to ransomware", "group": "context" }, { "key": "openness", "label": "Openness", "score": 70.2, "grade": "B-", "weight": 0.1, "n": 8, "confidence": "low", "headlineStat": "Advisories available by RSS. 3 of 3 advisories said the bug was exploited. 3 of 4 fixed zero-days with a public fix date for every version.", "group": "response" } ], "stats": { "kev12mo": 6, "kev24mo": 13, "kevAllTime": 37, "ransomware24mo": 2, "incidents24mo": 9, "privateCases": 41, "medianPrivateFixDays": 126.0, "deadlineMissRate": 0.561, "unpatchedDisclosures": 4, "medianSilenceHours": 0.0, "medianExposureHours": 0.0, "medianFollowThroughHours": 0.0, "exploitedBeforePatchRate": 0.444, "liveUnpatched": 1 }, "medianStrip": { "vendor": 0.0, "workaround": null, "patchFirst": 0.0, "patchAll": 0.0 }, "lastIncidentAt": "2026-10-13T14:33:02Z" }, { "slug": "fortinet", "name": "Fortinet", "categories": [ "edge", "security" ], "grade": "B+", "score": 80.4, "scoreInterval": [ 70.0, 90.8 ], "confidence": "low", "provisional": true, "provisionalReason": "7 reviewed zero-days. Not enough yet for a firm grade", "rank": 6, "privateFix": { "grade": "C+", "score": 69.8, "scoreInterval": [ 61.9, 77.7 ], "confidence": "medium", "provisional": false, "provisionalReason": null, "rank": 10, "n": 9 }, "trend": null, "responseN": 7, "subScores": [ { "key": "speed", "label": "Private fix speed", "score": 69.8, "grade": "C+", "weight": 1.0, "n": 9, "confidence": "medium", "headlineStat": "Median 161 days from private report to fix (9 cases, 3 with a vendor fix date)", "group": "privateFix" }, { "key": "silence", "label": "Time to first advisory", "score": 75.4, "grade": "B", "weight": 0.2, "n": 7, "confidence": "low", "headlineStat": "3 of 7 zero-days within a day, longest 39 days", "group": "response" }, { "key": "exposure", "label": "Time to first fix", "score": 78.6, "grade": "B", "weight": 0.4, "n": 7, "confidence": "low", "headlineStat": "2 of 7 zero-days within a day, longest 17 days", "group": "response" }, { "key": "followThrough", "label": "Time to fix all versions", "score": 83.5, "grade": "B+", "weight": 0.3, "n": 6, "confidence": "low", "headlineStat": "2 of 6 zero-days within a day, longest 25 days", "group": "response" }, { "key": "trackRecord", "label": "Exploited-bug burden", "score": 22.7, "grade": "F", "weight": 0.0, "n": 21, "confidence": "medium", "headlineStat": "12 KEV listings in 12 months, 17 in 24 months, 3 linked to ransomware", "group": "context" }, { "key": "openness", "label": "Openness", "score": 88.2, "grade": "A-", "weight": 0.1, "n": 14, "confidence": "high", "headlineStat": "Advisories published as CSAF. 7 of 7 zero-days with a dated revision history. 7 of 7 advisories said the bug was exploited. 6 of 7 fixed zero-days with a public fix date for every version. 2 of 5 zero-days not fixed within a day had an advisory or mitigation within 72 hours.", "group": "response" } ], "stats": { "kev12mo": 12, "kev24mo": 17, "kevAllTime": 32, "ransomware24mo": 3, "incidents24mo": 16, "privateCases": 9, "medianPrivateFixDays": 161.0, "deadlineMissRate": 0.778, "unpatchedDisclosures": 0, "medianSilenceHours": 48.0, "medianExposureHours": 96.0, "medianFollowThroughHours": 96.0, "exploitedBeforePatchRate": 0.412, "liveUnpatched": 0 }, "medianStrip": { "vendor": 48.0, "workaround": 72.0, "patchFirst": 96.0, "patchAll": 96.0 }, "lastIncidentAt": "2026-10-01T19:17:38Z" }, { "slug": "check-point", "name": "Check Point", "categories": [ "edge", "security" ], "grade": "B+", "score": 80.2, "scoreInterval": [ 70.0, 90.4 ], "confidence": "low", "provisional": true, "provisionalReason": "3 reviewed zero-days. Not enough yet for a firm grade", "rank": 7, "privateFix": { "grade": "NR", "score": null, "scoreInterval": null, "confidence": "none", "provisional": false, "provisionalReason": null, "rank": null, "n": 1 }, "trend": null, "responseN": 3, "subScores": [ { "key": "speed", "label": "Private fix speed", "score": 72.7, "grade": "B-", "weight": 0.0, "n": 1, "confidence": "low", "headlineStat": "Median 328 days from private report to ZDI's public advisory (1 case)", "group": "privateFix" }, { "key": "silence", "label": "Time to first advisory", "score": 84.7, "grade": "B+", "weight": 0.2, "n": 3, "confidence": "low", "headlineStat": "3 of 3 zero-days within a day", "group": "response" }, { "key": "exposure", "label": "Time to first fix", "score": 84.6, "grade": "B+", "weight": 0.4, "n": 3, "confidence": "low", "headlineStat": "3 of 3 zero-days within a day", "group": "response" }, { "key": "followThrough", "label": "Time to fix all versions", "score": 82.7, "grade": "B+", "weight": 0.3, "n": 2, "confidence": "low", "headlineStat": "2 of 2 zero-days within a day", "group": "response" }, { "key": "trackRecord", "label": "Exploited-bug burden", "score": 44.9, "grade": "D-", "weight": 0.0, "n": 5, "confidence": "low", "headlineStat": "4 KEV listings in 12 months, 4 in 24 months, 1 linked to ransomware", "group": "context" }, { "key": "openness", "label": "Openness", "score": 46.5, "grade": "D", "weight": 0.1, "n": 7, "confidence": "low", "headlineStat": "No machine-readable advisory feed listed. 1 of 1 advisories said the bug was exploited. 2 of 3 fixed zero-days with a public fix date for every version.", "group": "response" } ], "stats": { "kev12mo": 4, "kev24mo": 4, "kevAllTime": 5, "ransomware24mo": 1, "incidents24mo": 4, "privateCases": 1, "medianPrivateFixDays": 328.0, "deadlineMissRate": 1.0, "unpatchedDisclosures": 0, "medianSilenceHours": 0.0, "medianExposureHours": 0.0, "medianFollowThroughHours": 0.0, "exploitedBeforePatchRate": 0.75, "liveUnpatched": 0 }, "medianStrip": { "vendor": 0.0, "workaround": 0.0, "patchFirst": 0.0, "patchAll": 0.0 }, "lastIncidentAt": "2026-09-22T12:59:01Z" }, { "slug": "palo-alto-networks", "name": "Palo Alto Networks", "categories": [ "edge", "security" ], "grade": "B", "score": 79.7, "scoreInterval": [ 68.6, 90.8 ], "confidence": "low", "provisional": true, "provisionalReason": "3 reviewed zero-days. Not enough yet for a firm grade", "rank": 8, "privateFix": { "grade": "NR", "score": null, "scoreInterval": null, "confidence": "none", "provisional": false, "provisionalReason": null, "rank": null, "n": 0 }, "trend": null, "responseN": 3, "subScores": [ { "key": "speed", "label": "Private fix speed", "score": null, "grade": "NR", "weight": 0.0, "n": 0, "confidence": "none", "headlineStat": "No private reports in the last 36 months", "group": "privateFix" }, { "key": "silence", "label": "Time to first advisory", "score": 82.9, "grade": "B+", "weight": 0.2, "n": 3, "confidence": "low", "headlineStat": "3 of 3 zero-days within a day", "group": "response" }, { "key": "exposure", "label": "Time to first fix", "score": 76.8, "grade": "B", "weight": 0.4, "n": 3, "confidence": "low", "headlineStat": "1 of 3 zero-days within a day, longest 10 days", "group": "response" }, { "key": "followThrough", "label": "Time to fix all versions", "score": 78.6, "grade": "B", "weight": 0.3, "n": 3, "confidence": "low", "headlineStat": "0 of 3 zero-days within a day, longest 23 days", "group": "response" }, { "key": "trackRecord", "label": "Exploited-bug burden", "score": 37.5, "grade": "F", "weight": 0.0, "n": 12, "confidence": "low", "headlineStat": "3 KEV listings in 12 months, 11 in 24 months, 3 linked to ransomware", "group": "context" }, { "key": "openness", "label": "Openness", "score": 88.5, "grade": "A-", "weight": 0.1, "n": 10, "confidence": "medium", "headlineStat": "Advisories published as CSAF. 3 of 3 zero-days with a dated revision history. 3 of 3 advisories said the bug was exploited. 3 of 3 fixed zero-days with a public fix date for every version. 2 of 2 zero-days not fixed within a day had an advisory or mitigation within 72 hours.", "group": "response" } ], "stats": { "kev12mo": 3, "kev24mo": 11, "kevAllTime": 16, "ransomware24mo": 3, "incidents24mo": 8, "privateCases": 0, "medianPrivateFixDays": null, "deadlineMissRate": null, "unpatchedDisclosures": 0, "medianSilenceHours": 0.0, "medianExposureHours": 185.0, "medianFollowThroughHours": 241.33, "exploitedBeforePatchRate": 0.375, "liveUnpatched": 0 }, "medianStrip": { "vendor": 0.0, "workaround": 0.0, "patchFirst": 185.0, "patchAll": 241.33 }, "lastIncidentAt": "2026-10-14T16:00:00Z" }, { "slug": "oracle", "name": "Oracle", "categories": [ "enterprise-apps", "infrastructure" ], "grade": "B", "score": 79.0, "scoreInterval": [ 68.1, 89.9 ], "confidence": "low", "provisional": true, "provisionalReason": "4 reviewed zero-days. Not enough yet for a firm grade", "rank": 9, "privateFix": { "grade": "B", "score": 78.1, "scoreInterval": [ 68.2, 88.0 ], "confidence": "low", "provisional": true, "provisionalReason": "Wide range: 68–88", "rank": 4, "n": 25 }, "trend": null, "responseN": 4, "subScores": [ { "key": "speed", "label": "Private fix speed", "score": 78.1, "grade": "B", "weight": 1.0, "n": 25, "confidence": "low", "headlineStat": "Median 64 days from private report to ZDI's public advisory (25 cases)", "group": "privateFix" }, { "key": "silence", "label": "Time to first advisory", "score": 77.8, "grade": "B", "weight": 0.2, "n": 4, "confidence": "low", "headlineStat": "2 of 4 zero-days within a day, longest 7 days", "group": "response" }, { "key": "exposure", "label": "Time to first fix", "score": 78.9, "grade": "B", "weight": 0.4, "n": 4, "confidence": "low", "headlineStat": "1 of 4 zero-days within a day, longest 7 days", "group": "response" }, { "key": "followThrough", "label": "Time to fix all versions", "score": 83.0, "grade": "B+", "weight": 0.3, "n": 4, "confidence": "low", "headlineStat": "1 of 4 zero-days within a day, longest 7 days", "group": "response" }, { "key": "trackRecord", "label": "Exploited-bug burden", "score": 31.7, "grade": "F", "weight": 0.0, "n": 14, "confidence": "low", "headlineStat": "5 KEV listings in 12 months, 10 in 24 months, 3 linked to ransomware", "group": "context" }, { "key": "openness", "label": "Openness", "score": 69.8, "grade": "C+", "weight": 0.1, "n": 7, "confidence": "low", "headlineStat": "Advisories available by RSS. 4 of 4 zero-days with a dated revision history. 4 of 4 fixed zero-days with a public fix date for every version. 2 of 3 zero-days not fixed within a day had an advisory or mitigation within 72 hours.", "group": "response" } ], "stats": { "kev12mo": 5, "kev24mo": 10, "kevAllTime": 46, "ransomware24mo": 3, "incidents24mo": 10, "privateCases": 25, "medianPrivateFixDays": 64.0, "deadlineMissRate": 0.28, "unpatchedDisclosures": 0, "medianSilenceHours": 24.0, "medianExposureHours": 96.0, "medianFollowThroughHours": 96.0, "exploitedBeforePatchRate": 0.444, "liveUnpatched": 0 }, "medianStrip": { "vendor": 24.0, "workaround": 0.0, "patchFirst": 96.0, "patchAll": 96.0 }, "lastIncidentAt": "2026-06-10T18:31:00Z" }, { "slug": "microsoft", "name": "Microsoft", "categories": [ "platform", "enterprise-apps" ], "grade": "B", "score": 75.2, "scoreInterval": [ 62.7, 87.7 ], "confidence": "low", "provisional": true, "provisionalReason": "3 reviewed zero-days. Not enough yet for a firm grade", "rank": 10, "privateFix": { "grade": "C", "score": 62.8, "scoreInterval": [ 54.1, 71.4 ], "confidence": "low", "provisional": true, "provisionalReason": "Wide range: 54–71", "rank": 16, "n": 112 }, "trend": null, "responseN": 3, "subScores": [ { "key": "speed", "label": "Private fix speed", "score": 62.8, "grade": "C", "weight": 1.0, "n": 112, "confidence": "low", "headlineStat": "Median 140 days from private report to fix (112 cases, 24 with a vendor fix date, 32 published without a fix)", "group": "privateFix" }, { "key": "silence", "label": "Time to first advisory", "score": 81.6, "grade": "B+", "weight": 0.2, "n": 3, "confidence": "low", "headlineStat": "3 of 3 zero-days within a day", "group": "response" }, { "key": "exposure", "label": "Time to first fix", "score": 67.5, "grade": "C+", "weight": 0.4, "n": 3, "confidence": "low", "headlineStat": "1 of 3 zero-days within a day, longest 26 days", "group": "response" }, { "key": "followThrough", "label": "Time to fix all versions", "score": 76.7, "grade": "B", "weight": 0.3, "n": 3, "confidence": "low", "headlineStat": "1 of 3 zero-days within a day, longest 26 days", "group": "response" }, { "key": "trackRecord", "label": "Exploited-bug burden", "score": 5.9, "grade": "F", "weight": 0.0, "n": 119, "confidence": "high", "headlineStat": "43 KEV listings in 12 months, 83 in 24 months, 12 linked to ransomware", "group": "context" }, { "key": "openness", "label": "Openness", "score": 88.5, "grade": "A-", "weight": 0.1, "n": 11, "confidence": "medium", "headlineStat": "Advisories published as CSAF. 3 of 3 zero-days with a dated revision history. 3 of 3 advisories said the bug was exploited. 3 of 3 fixed zero-days with a public fix date for every version. 2 of 2 zero-days not fixed within a day had an advisory or mitigation within 72 hours.", "group": "response" } ], "stats": { "kev12mo": 43, "kev24mo": 83, "kevAllTime": 390, "ransomware24mo": 12, "incidents24mo": 81, "privateCases": 112, "medianPrivateFixDays": 140.0, "deadlineMissRate": 0.625, "unpatchedDisclosures": 32, "medianSilenceHours": 0.0, "medianExposureHours": 288.0, "medianFollowThroughHours": 312.0, "exploitedBeforePatchRate": 0.75, "liveUnpatched": 0 }, "medianStrip": { "vendor": 0.0, "workaround": 132.0, "patchFirst": 288.0, "patchAll": 312.0 }, "lastIncidentAt": "2026-10-13T19:01:26Z" }, { "slug": "adobe", "name": "Adobe", "categories": [ "enterprise-apps" ], "grade": "NR", "score": null, "scoreInterval": null, "confidence": "none", "provisional": false, "provisionalReason": null, "rank": null, "privateFix": { "grade": "B", "score": 76.5, "scoreInterval": [ 70.5, 82.4 ], "confidence": "medium", "provisional": false, "provisionalReason": null, "rank": 3, "n": 56 }, "trend": null, "responseN": 0, "subScores": [ { "key": "speed", "label": "Private fix speed", "score": 76.5, "grade": "B", "weight": 1.0, "n": 56, "confidence": "medium", "headlineStat": "Median 88 days from private report to ZDI's public advisory (56 cases)", "group": "privateFix" }, { "key": "silence", "label": "Time to first advisory", "score": null, "grade": "NR", "weight": 0.0, "n": 0, "confidence": "none", "headlineStat": "No reviewed zero-days in the last 36 months", "group": "response" }, { "key": "exposure", "label": "Time to first fix", "score": null, "grade": "NR", "weight": 0.0, "n": 0, "confidence": "none", "headlineStat": "No reviewed zero-days in the last 36 months", "group": "response" }, { "key": "followThrough", "label": "Time to fix all versions", "score": null, "grade": "NR", "weight": 0.0, "n": 0, "confidence": "none", "headlineStat": "No reviewed zero-days in the last 36 months", "group": "response" }, { "key": "trackRecord", "label": "Exploited-bug burden", "score": 31.8, "grade": "F", "weight": 0.0, "n": 17, "confidence": "low", "headlineStat": "7 KEV listings in 12 months, 10 in 24 months, 0 linked to ransomware", "group": "context" }, { "key": "openness", "label": "Openness", "score": 41.7, "grade": "D-", "weight": 0.0, "n": 4, "confidence": "low", "headlineStat": "No machine-readable advisory feed listed", "group": "response" } ], "stats": { "kev12mo": 7, "kev24mo": 10, "kevAllTime": 82, "ransomware24mo": 0, "incidents24mo": 10, "privateCases": 56, "medianPrivateFixDays": 88.5, "deadlineMissRate": 0.196, "unpatchedDisclosures": 0, "medianSilenceHours": null, "medianExposureHours": null, "medianFollowThroughHours": null, "exploitedBeforePatchRate": 0.0, "liveUnpatched": 0 }, "medianStrip": { "vendor": null, "workaround": null, "patchFirst": null, "patchAll": null }, "lastIncidentAt": "2026-09-07T20:17:16Z" }, { "slug": "apple", "name": "Apple", "categories": [ "platform" ], "grade": "NR", "score": null, "scoreInterval": null, "confidence": "none", "provisional": false, "provisionalReason": null, "rank": null, "privateFix": { "grade": "B", "score": 79.2, "scoreInterval": [ 74.1, 84.4 ], "confidence": "medium", "provisional": false, "provisionalReason": null, "rank": 1, "n": 78 }, "trend": null, "responseN": 1, "subScores": [ { "key": "speed", "label": "Private fix speed", "score": 79.2, "grade": "B", "weight": 1.0, "n": 78, "confidence": "medium", "headlineStat": "Median 104 days from private report to fix (78 cases, 25 with a vendor fix date)", "group": "privateFix" }, { "key": "silence", "label": "Time to first advisory", "score": 76.7, "grade": "B", "weight": 0.0, "n": 1, "confidence": "low", "headlineStat": "1 zero-day, 2 days", "group": "response" }, { "key": "exposure", "label": "Time to first fix", "score": 77.7, "grade": "B", "weight": 0.0, "n": 1, "confidence": "low", "headlineStat": "1 zero-day, 2 days", "group": "response" }, { "key": "followThrough", "label": "Time to fix all versions", "score": 78.0, "grade": "B", "weight": 0.0, "n": 1, "confidence": "low", "headlineStat": "1 zero-day, 2 days", "group": "response" }, { "key": "trackRecord", "label": "Exploited-bug burden", "score": 24.9, "grade": "F", "weight": 0.0, "n": 27, "confidence": "medium", "headlineStat": "10 KEV listings in 12 months, 20 in 24 months, 0 linked to ransomware", "group": "context" }, { "key": "openness", "label": "Openness", "score": 51.7, "grade": "D+", "weight": 0.0, "n": 4, "confidence": "low", "headlineStat": "No machine-readable advisory feed listed. 1 of 1 zero-day with a dated revision history. 1 of 1 advisories said the bug was exploited. 1 of 1 fixed zero-day with a public fix date for every version. 1 of 1 zero-day not fixed within a day had an advisory or mitigation within 72 hours.", "group": "response" } ], "stats": { "kev12mo": 10, "kev24mo": 20, "kevAllTime": 95, "ransomware24mo": 0, "incidents24mo": 20, "privateCases": 78, "medianPrivateFixDays": 104.5, "deadlineMissRate": 0.308, "unpatchedDisclosures": 0, "medianSilenceHours": 48.0, "medianExposureHours": 48.0, "medianFollowThroughHours": 48.0, "exploitedBeforePatchRate": 1.0, "liveUnpatched": 0 }, "medianStrip": { "vendor": 48.0, "workaround": null, "patchFirst": 48.0, "patchAll": 48.0 }, "lastIncidentAt": "2026-09-28T19:13:52Z" }, { "slug": "atlassian", "name": "Atlassian", "categories": [ "enterprise-apps", "devtools" ], "grade": "NR", "score": null, "scoreInterval": null, "confidence": "none", "provisional": false, "provisionalReason": null, "rank": null, "privateFix": { "grade": "NR", "score": null, "scoreInterval": null, "confidence": "none", "provisional": false, "provisionalReason": null, "rank": null, "n": 0 }, "trend": null, "responseN": 0, "subScores": [ { "key": "speed", "label": "Private fix speed", "score": null, "grade": "NR", "weight": 0.0, "n": 0, "confidence": "none", "headlineStat": "No private reports in the last 36 months", "group": "privateFix" }, { "key": "silence", "label": "Time to first advisory", "score": null, "grade": "NR", "weight": 0.0, "n": 0, "confidence": "none", "headlineStat": "No reviewed zero-days in the last 36 months", "group": "response" }, { "key": "exposure", "label": "Time to first fix", "score": null, "grade": "NR", "weight": 0.0, "n": 0, "confidence": "none", "headlineStat": "No reviewed zero-days in the last 36 months", "group": "response" }, { "key": "followThrough", "label": "Time to fix all versions", "score": null, "grade": "NR", "weight": 0.0, "n": 0, "confidence": "none", "headlineStat": "No reviewed zero-days in the last 36 months", "group": "response" }, { "key": "trackRecord", "label": "Exploited-bug burden", "score": 67.8, "grade": "C+", "weight": 0.0, "n": 4, "confidence": "low", "headlineStat": "1 KEV listings in 12 months, 2 in 24 months, 0 linked to ransomware", "group": "context" }, { "key": "openness", "label": "Openness", "score": 25.0, "grade": "F", "weight": 0.0, "n": 2, "confidence": "low", "headlineStat": "No machine-readable advisory feed listed. No public alert channel listed.", "group": "response" } ], "stats": { "kev12mo": 1, "kev24mo": 2, "kevAllTime": 14, "ransomware24mo": 0, "incidents24mo": 2, "privateCases": 0, "medianPrivateFixDays": null, "deadlineMissRate": null, "unpatchedDisclosures": 0, "medianSilenceHours": null, "medianExposureHours": null, "medianFollowThroughHours": null, "exploitedBeforePatchRate": 0.0, "liveUnpatched": 0 }, "medianStrip": { "vendor": null, "workaround": null, "patchFirst": null, "patchAll": null }, "lastIncidentAt": "2026-10-05T00:00:00Z" }, { "slug": "broadcom-vmware", "name": "Broadcom (VMware)", "categories": [ "infrastructure" ], "grade": "NR", "score": null, "scoreInterval": null, "confidence": "none", "provisional": false, "provisionalReason": null, "rank": null, "privateFix": { "grade": "B", "score": 77.3, "scoreInterval": [ 65.0, 89.5 ], "confidence": "low", "provisional": true, "provisionalReason": "9 private reports, published on 8 dates. Not enough yet for a firm grade", "rank": 8, "n": 9 }, "trend": null, "responseN": 2, "subScores": [ { "key": "speed", "label": "Private fix speed", "score": 77.3, "grade": "B", "weight": 1.0, "n": 9, "confidence": "low", "headlineStat": "Median 70 days from private report to ZDI's public advisory (9 cases)", "group": "privateFix" }, { "key": "silence", "label": "Time to first advisory", "score": 78.7, "grade": "B", "weight": 0.0, "n": 2, "confidence": "low", "headlineStat": "2 of 2 zero-days within a day", "group": "response" }, { "key": "exposure", "label": "Time to first fix", "score": 79.0, "grade": "B", "weight": 0.0, "n": 2, "confidence": "low", "headlineStat": "2 of 2 zero-days within a day", "group": "response" }, { "key": "followThrough", "label": "Time to fix all versions", "score": 79.0, "grade": "B", "weight": 0.0, "n": 2, "confidence": "low", "headlineStat": "2 of 2 zero-days within a day", "group": "response" }, { "key": "trackRecord", "label": "Exploited-bug burden", "score": 37.0, "grade": "F", "weight": 0.0, "n": 13, "confidence": "low", "headlineStat": "4 KEV listings in 12 months, 10 in 24 months, 2 linked to ransomware", "group": "context" }, { "key": "openness", "label": "Openness", "score": 68.1, "grade": "C+", "weight": 0.0, "n": 6, "confidence": "low", "headlineStat": "Advisories available by RSS. 1 of 1 advisories said the bug was exploited. 2 of 2 fixed zero-days with a public fix date for every version.", "group": "response" } ], "stats": { "kev12mo": 4, "kev24mo": 10, "kevAllTime": 34, "ransomware24mo": 2, "incidents24mo": 7, "privateCases": 9, "medianPrivateFixDays": 70.0, "deadlineMissRate": 0.333, "unpatchedDisclosures": 0, "medianSilenceHours": 0.0, "medianExposureHours": 0.0, "medianFollowThroughHours": 0.0, "exploitedBeforePatchRate": 0.333, "liveUnpatched": 0 }, "medianStrip": { "vendor": 0.0, "workaround": null, "patchFirst": 0.0, "patchAll": 0.0 }, "lastIncidentAt": "2026-07-29T00:00:00Z" }, { "slug": "commvault", "name": "Commvault", "categories": [ "it-management", "infrastructure" ], "grade": "NR", "score": null, "scoreInterval": null, "confidence": "none", "provisional": false, "provisionalReason": null, "rank": null, "privateFix": { "grade": "NR", "score": null, "scoreInterval": null, "confidence": "none", "provisional": false, "provisionalReason": null, "rank": null, "n": 0 }, "trend": null, "responseN": 2, "subScores": [ { "key": "speed", "label": "Private fix speed", "score": null, "grade": "NR", "weight": 0.0, "n": 0, "confidence": "none", "headlineStat": "No private reports in the last 36 months", "group": "privateFix" }, { "key": "silence", "label": "Time to first advisory", "score": 78.6, "grade": "B", "weight": 0.0, "n": 2, "confidence": "low", "headlineStat": "2 of 2 zero-days within a day", "group": "response" }, { "key": "exposure", "label": "Time to first fix", "score": 69.8, "grade": "C+", "weight": 0.0, "n": 2, "confidence": "low", "headlineStat": "0 of 2 zero-days within a day, longest 19 days", "group": "response" }, { "key": "followThrough", "label": "Time to fix all versions", "score": 76.0, "grade": "B", "weight": 0.0, "n": 2, "confidence": "low", "headlineStat": "0 of 2 zero-days within a day, longest 19 days", "group": "response" }, { "key": "trackRecord", "label": "Exploited-bug burden", "score": 84.1, "grade": "B+", "weight": 0.0, "n": 2, "confidence": "low", "headlineStat": "0 KEV listings in 12 months, 2 in 24 months, 0 linked to ransomware", "group": "context" }, { "key": "openness", "label": "Openness", "score": 54.6, "grade": "D+", "weight": 0.0, "n": 5, "confidence": "medium", "headlineStat": "No machine-readable advisory feed listed. 2 of 2 zero-days with a dated revision history. 1 of 1 advisories said the bug was exploited. 2 of 2 fixed zero-days with a public fix date for every version. 2 of 2 zero-days not fixed within a day had an advisory or mitigation within 72 hours.", "group": "response" } ], "stats": { "kev12mo": 0, "kev24mo": 2, "kevAllTime": 2, "ransomware24mo": 0, "incidents24mo": 2, "privateCases": 0, "medianPrivateFixDays": null, "deadlineMissRate": null, "unpatchedDisclosures": 0, "medianSilenceHours": 0.0, "medianExposureHours": 360.0, "medianFollowThroughHours": 396.0, "exploitedBeforePatchRate": 1.0, "liveUnpatched": 0 }, "medianStrip": { "vendor": 0.0, "workaround": 120.0, "patchFirst": 360.0, "patchAll": 396.0 }, "lastIncidentAt": "2025-04-17T00:00:00Z" }, { "slug": "connectwise", "name": "ConnectWise", "categories": [ "it-management" ], "grade": "NR", "score": null, "scoreInterval": null, "confidence": "none", "provisional": false, "provisionalReason": null, "rank": null, "privateFix": { "grade": "NR", "score": null, "scoreInterval": null, "confidence": "none", "provisional": false, "provisionalReason": null, "rank": null, "n": 0 }, "trend": null, "responseN": 2, "subScores": [ { "key": "speed", "label": "Private fix speed", "score": null, "grade": "NR", "weight": 0.0, "n": 0, "confidence": "none", "headlineStat": "No private reports in the last 36 months", "group": "privateFix" }, { "key": "silence", "label": "Time to first advisory", "score": 81.4, "grade": "B+", "weight": 0.0, "n": 2, "confidence": "low", "headlineStat": "2 of 2 zero-days within a day", "group": "response" }, { "key": "exposure", "label": "Time to first fix", "score": 78.4, "grade": "B", "weight": 0.0, "n": 2, "confidence": "low", "headlineStat": "1 of 2 zero-days within a day, longest 5 days", "group": "response" }, { "key": "followThrough", "label": "Time to fix all versions", "score": 81.0, "grade": "B+", "weight": 0.0, "n": 2, "confidence": "low", "headlineStat": "1 of 2 zero-days within a day, longest 5 days", "group": "response" }, { "key": "trackRecord", "label": "Exploited-bug burden", "score": 55.5, "grade": "C-", "weight": 0.0, "n": 4, "confidence": "low", "headlineStat": "2 KEV listings in 12 months, 3 in 24 months, 1 linked to ransomware", "group": "context" }, { "key": "openness", "label": "Openness", "score": 67.2, "grade": "C+", "weight": 0.0, "n": 4, "confidence": "low", "headlineStat": "Advisories available by RSS. 1 of 1 zero-day with a dated revision history. 2 of 2 fixed zero-days with a public fix date for every version. 1 of 1 zero-day not fixed within a day had an advisory or mitigation within 72 hours.", "group": "response" } ], "stats": { "kev12mo": 2, "kev24mo": 3, "kevAllTime": 4, "ransomware24mo": 1, "incidents24mo": 2, "privateCases": 0, "medianPrivateFixDays": null, "deadlineMissRate": null, "unpatchedDisclosures": 0, "medianSilenceHours": 0.0, "medianExposureHours": 60.0, "medianFollowThroughHours": 60.0, "exploitedBeforePatchRate": 0.667, "liveUnpatched": 0 }, "medianStrip": { "vendor": 0.0, "workaround": 0.0, "patchFirst": 60.0, "patchAll": 60.0 }, "lastIncidentAt": "2026-09-03T00:00:00Z" }, { "slug": "crushftp", "name": "CrushFTP", "categories": [ "enterprise-apps" ], "grade": "NR", "score": null, "scoreInterval": null, "confidence": "none", "provisional": false, "provisionalReason": null, "rank": null, "privateFix": { "grade": "NR", "score": null, "scoreInterval": null, "confidence": "none", "provisional": false, "provisionalReason": null, "rank": null, "n": 0 }, "trend": null, "responseN": 0, "subScores": [ { "key": "speed", "label": "Private fix speed", "score": null, "grade": "NR", "weight": 0.0, "n": 0, "confidence": "none", "headlineStat": "No private reports in the last 36 months", "group": "privateFix" }, { "key": "silence", "label": "Time to first advisory", "score": null, "grade": "NR", "weight": 0.0, "n": 0, "confidence": "none", "headlineStat": "No reviewed zero-days in the last 36 months", "group": "response" }, { "key": "exposure", "label": "Time to first fix", "score": null, "grade": "NR", "weight": 0.0, "n": 0, "confidence": "none", "headlineStat": "No reviewed zero-days in the last 36 months", "group": "response" }, { "key": "followThrough", "label": "Time to fix all versions", "score": null, "grade": "NR", "weight": 0.0, "n": 0, "confidence": "none", "headlineStat": "No reviewed zero-days in the last 36 months", "group": "response" }, { "key": "trackRecord", "label": "Exploited-bug burden", "score": 74.7, "grade": "B-", "weight": 0.0, "n": 3, "confidence": "low", "headlineStat": "0 KEV listings in 12 months, 2 in 24 months, 1 linked to ransomware", "group": "context" }, { "key": "openness", "label": "Openness", "score": 25.0, "grade": "F", "weight": 0.0, "n": 2, "confidence": "low", "headlineStat": "No machine-readable advisory feed listed. No public alert channel listed.", "group": "response" } ], "stats": { "kev12mo": 0, "kev24mo": 2, "kevAllTime": 3, "ransomware24mo": 1, "incidents24mo": 2, "privateCases": 0, "medianPrivateFixDays": null, "deadlineMissRate": null, "unpatchedDisclosures": 0, "medianSilenceHours": null, "medianExposureHours": null, "medianFollowThroughHours": null, "exploitedBeforePatchRate": 0.0, "liveUnpatched": 0 }, "medianStrip": { "vendor": null, "workaround": null, "patchFirst": null, "patchAll": null }, "lastIncidentAt": "2025-07-18T00:00:00Z" }, { "slug": "docker", "name": "Docker", "categories": [ "devtools" ], "grade": "NR", "score": null, "scoreInterval": null, "confidence": "none", "provisional": false, "provisionalReason": null, "rank": null, "privateFix": { "grade": "B-", "score": 73.4, "scoreInterval": [ 63.3, 83.5 ], "confidence": "low", "provisional": true, "provisionalReason": "Wide range: 63–84", "rank": 9, "n": 16 }, "trend": null, "responseN": 0, "subScores": [ { "key": "speed", "label": "Private fix speed", "score": 73.4, "grade": "B-", "weight": 1.0, "n": 16, "confidence": "low", "headlineStat": "Median 111 days from private report to ZDI's public advisory (16 cases, 4 published without a fix)", "group": "privateFix" }, { "key": "silence", "label": "Time to first advisory", "score": null, "grade": "NR", "weight": 0.0, "n": 0, "confidence": "none", "headlineStat": "No reviewed zero-days in the last 36 months", "group": "response" }, { "key": "exposure", "label": "Time to first fix", "score": null, "grade": "NR", "weight": 0.0, "n": 0, "confidence": "none", "headlineStat": "No reviewed zero-days in the last 36 months", "group": "response" }, { "key": "followThrough", "label": "Time to fix all versions", "score": null, "grade": "NR", "weight": 0.0, "n": 0, "confidence": "none", "headlineStat": "No reviewed zero-days in the last 36 months", "group": "response" }, { "key": "trackRecord", "label": "Exploited-bug burden", "score": 100.0, "grade": "A+", "weight": 0.0, "n": 0, "confidence": "low", "headlineStat": "No KEV listings in the last 24 months", "group": "context" }, { "key": "openness", "label": "Openness", "score": 61.7, "grade": "C", "weight": 0.0, "n": 5, "confidence": "low", "headlineStat": "Advisories available by RSS", "group": "response" } ], "stats": { "kev12mo": 0, "kev24mo": 0, "kevAllTime": 1, "ransomware24mo": 0, "incidents24mo": 0, "privateCases": 16, "medianPrivateFixDays": 111.0, "deadlineMissRate": 0.438, "unpatchedDisclosures": 4, "medianSilenceHours": null, "medianExposureHours": null, "medianFollowThroughHours": null, "exploitedBeforePatchRate": null, "liveUnpatched": 0 }, "medianStrip": { "vendor": null, "workaround": null, "patchFirst": null, "patchAll": null }, "lastIncidentAt": null }, { "slug": "f5", "name": "F5", "categories": [ "edge" ], "grade": "NR", "score": null, "scoreInterval": null, "confidence": "none", "provisional": false, "provisionalReason": null, "rank": null, "privateFix": { "grade": "NR", "score": null, "scoreInterval": null, "confidence": "none", "provisional": false, "provisionalReason": null, "rank": null, "n": 0 }, "trend": null, "responseN": 1, "subScores": [ { "key": "speed", "label": "Private fix speed", "score": null, "grade": "NR", "weight": 0.0, "n": 0, "confidence": "none", "headlineStat": "No private reports in the last 36 months", "group": "privateFix" }, { "key": "silence", "label": "Time to first advisory", "score": 79.8, "grade": "B", "weight": 0.0, "n": 1, "confidence": "low", "headlineStat": "1 zero-day, within a day", "group": "response" }, { "key": "exposure", "label": "Time to first fix", "score": 79.8, "grade": "B", "weight": 0.0, "n": 1, "confidence": "low", "headlineStat": "1 zero-day, within a day", "group": "response" }, { "key": "followThrough", "label": "Time to fix all versions", "score": 79.8, "grade": "B", "weight": 0.0, "n": 1, "confidence": "low", "headlineStat": "1 zero-day, within a day", "group": "response" }, { "key": "trackRecord", "label": "Exploited-bug burden", "score": 65.5, "grade": "C+", "weight": 0.0, "n": 4, "confidence": "low", "headlineStat": "2 KEV listings in 12 months, 2 in 24 months, 0 linked to ransomware", "group": "context" }, { "key": "openness", "label": "Openness", "score": 43.5, "grade": "D-", "weight": 0.0, "n": 3, "confidence": "low", "headlineStat": "No machine-readable advisory feed listed. 1 of 1 fixed zero-day with a public fix date for every version.", "group": "response" } ], "stats": { "kev12mo": 2, "kev24mo": 2, "kevAllTime": 8, "ransomware24mo": 0, "incidents24mo": 2, "privateCases": 0, "medianPrivateFixDays": null, "deadlineMissRate": null, "unpatchedDisclosures": 0, "medianSilenceHours": 0.0, "medianExposureHours": 0.0, "medianFollowThroughHours": 0.0, "exploitedBeforePatchRate": 0.5, "liveUnpatched": 0 }, "medianStrip": { "vendor": 0.0, "workaround": 0.0, "patchFirst": 0.0, "patchAll": 0.0 }, "lastIncidentAt": "2026-09-22T14:17:42Z" }, { "slug": "gitlab", "name": "GitLab", "categories": [ "devtools" ], "grade": "NR", "score": null, "scoreInterval": null, "confidence": "none", "provisional": false, "provisionalReason": null, "rank": null, "privateFix": { "grade": "NR", "score": null, "scoreInterval": null, "confidence": "none", "provisional": false, "provisionalReason": null, "rank": null, "n": 1 }, "trend": null, "responseN": 0, "subScores": [ { "key": "speed", "label": "Private fix speed", "score": 73.8, "grade": "B-", "weight": 0.0, "n": 1, "confidence": "low", "headlineStat": "Median 231 days from private report to the vendor's fix (1 case)", "group": "privateFix" }, { "key": "silence", "label": "Time to first advisory", "score": null, "grade": "NR", "weight": 0.0, "n": 0, "confidence": "none", "headlineStat": "No reviewed zero-days in the last 36 months", "group": "response" }, { "key": "exposure", "label": "Time to first fix", "score": null, "grade": "NR", "weight": 0.0, "n": 0, "confidence": "none", "headlineStat": "No reviewed zero-days in the last 36 months", "group": "response" }, { "key": "followThrough", "label": "Time to fix all versions", "score": null, "grade": "NR", "weight": 0.0, "n": 0, "confidence": "none", "headlineStat": "No reviewed zero-days in the last 36 months", "group": "response" }, { "key": "trackRecord", "label": "Exploited-bug burden", "score": 61.9, "grade": "C", "weight": 0.0, "n": 4, "confidence": "low", "headlineStat": "3 KEV listings in 12 months, 3 in 24 months, 0 linked to ransomware", "group": "context" }, { "key": "openness", "label": "Openness", "score": 61.7, "grade": "C", "weight": 0.0, "n": 4, "confidence": "low", "headlineStat": "Advisories available by RSS", "group": "response" } ], "stats": { "kev12mo": 3, "kev24mo": 3, "kevAllTime": 5, "ransomware24mo": 0, "incidents24mo": 3, "privateCases": 1, "medianPrivateFixDays": 231.0, "deadlineMissRate": 1.0, "unpatchedDisclosures": 0, "medianSilenceHours": null, "medianExposureHours": null, "medianFollowThroughHours": null, "exploitedBeforePatchRate": 0.0, "liveUnpatched": 0 }, "medianStrip": { "vendor": null, "workaround": null, "patchFirst": null, "patchAll": null }, "lastIncidentAt": "2026-09-10T00:00:00Z" }, { "slug": "google", "name": "Google", "categories": [ "platform" ], "grade": "NR", "score": null, "scoreInterval": null, "confidence": "none", "provisional": false, "provisionalReason": null, "rank": null, "privateFix": { "grade": "C", "score": 64.6, "scoreInterval": [ 49.5, 79.8 ], "confidence": "low", "provisional": true, "provisionalReason": "8 private reports, published on 6 dates. Not enough yet for a firm grade", "rank": 20, "n": 8 }, "trend": null, "responseN": 0, "subScores": [ { "key": "speed", "label": "Private fix speed", "score": 64.6, "grade": "C", "weight": 1.0, "n": 8, "confidence": "low", "headlineStat": "Median 299 days from private report to ZDI's public advisory (8 cases, 3 published without a fix)", "group": "privateFix" }, { "key": "silence", "label": "Time to first advisory", "score": null, "grade": "NR", "weight": 0.0, "n": 0, "confidence": "none", "headlineStat": "No reviewed zero-days in the last 36 months", "group": "response" }, { "key": "exposure", "label": "Time to first fix", "score": null, "grade": "NR", "weight": 0.0, "n": 0, "confidence": "none", "headlineStat": "No reviewed zero-days in the last 36 months", "group": "response" }, { "key": "followThrough", "label": "Time to fix all versions", "score": null, "grade": "NR", "weight": 0.0, "n": 0, "confidence": "none", "headlineStat": "No reviewed zero-days in the last 36 months", "group": "response" }, { "key": "trackRecord", "label": "Exploited-bug burden", "score": 20.8, "grade": "F", "weight": 0.0, "n": 35, "confidence": "high", "headlineStat": "13 KEV listings in 12 months, 20 in 24 months, 0 linked to ransomware", "group": "context" }, { "key": "openness", "label": "Openness", "score": 61.7, "grade": "C", "weight": 0.0, "n": 6, "confidence": "low", "headlineStat": "Advisories available by RSS", "group": "response" } ], "stats": { "kev12mo": 13, "kev24mo": 20, "kevAllTime": 92, "ransomware24mo": 0, "incidents24mo": 19, "privateCases": 8, "medianPrivateFixDays": 299.0, "deadlineMissRate": 0.875, "unpatchedDisclosures": 3, "medianSilenceHours": null, "medianExposureHours": null, "medianFollowThroughHours": null, "exploitedBeforePatchRate": null, "liveUnpatched": 0 }, "medianStrip": { "vendor": null, "workaround": null, "patchFirst": null, "patchAll": null }, "lastIncidentAt": "2026-09-15T18:34:37Z" }, { "slug": "juniper", "name": "Juniper Networks", "categories": [ "edge", "infrastructure" ], "grade": "NR", "score": null, "scoreInterval": null, "confidence": "none", "provisional": false, "provisionalReason": null, "rank": null, "privateFix": { "grade": "NR", "score": null, "scoreInterval": null, "confidence": "none", "provisional": false, "provisionalReason": null, "rank": null, "n": 0 }, "trend": null, "responseN": 1, "subScores": [ { "key": "speed", "label": "Private fix speed", "score": null, "grade": "NR", "weight": 0.0, "n": 0, "confidence": "none", "headlineStat": "No private reports in the last 36 months", "group": "privateFix" }, { "key": "silence", "label": "Time to first advisory", "score": 76.5, "grade": "B", "weight": 0.0, "n": 1, "confidence": "low", "headlineStat": "1 zero-day, within a day", "group": "response" }, { "key": "exposure", "label": "Time to first fix", "score": 76.8, "grade": "B", "weight": 0.0, "n": 1, "confidence": "low", "headlineStat": "1 zero-day, within a day", "group": "response" }, { "key": "followThrough", "label": "Time to fix all versions", "score": 69.4, "grade": "C+", "weight": 0.0, "n": 1, "confidence": "low", "headlineStat": "1 zero-day, still open after 592 days", "group": "response" }, { "key": "trackRecord", "label": "Exploited-bug burden", "score": 72.2, "grade": "B-", "weight": 0.0, "n": 7, "confidence": "low", "headlineStat": "0 KEV listings in 12 months, 2 in 24 months, 0 linked to ransomware", "group": "context" }, { "key": "openness", "label": "Openness", "score": 44.4, "grade": "D-", "weight": 0.0, "n": 3, "confidence": "low", "headlineStat": "No machine-readable advisory feed listed. 1 of 1 zero-day with a dated revision history.", "group": "response" } ], "stats": { "kev12mo": 0, "kev24mo": 2, "kevAllTime": 8, "ransomware24mo": 0, "incidents24mo": 2, "privateCases": 0, "medianPrivateFixDays": null, "deadlineMissRate": null, "unpatchedDisclosures": 0, "medianSilenceHours": 24.0, "medianExposureHours": 24.0, "medianFollowThroughHours": null, "exploitedBeforePatchRate": 0.5, "liveUnpatched": 1 }, "medianStrip": { "vendor": 24.0, "workaround": 24.0, "patchFirst": 24.0, "patchAll": null }, "lastIncidentAt": "2025-03-11T00:00:00Z" }, { "slug": "linux-kernel", "name": "Linux kernel", "categories": [ "platform" ], "grade": "NR", "score": null, "scoreInterval": null, "confidence": "none", "provisional": false, "provisionalReason": null, "rank": null, "privateFix": { "grade": "B-", "score": 70.5, "scoreInterval": [ 60.4, 80.6 ], "confidence": "low", "provisional": true, "provisionalReason": "Wide range: 60–81", "rank": 13, "n": 56 }, "trend": null, "responseN": 2, "subScores": [ { "key": "speed", "label": "Private fix speed", "score": 70.5, "grade": "B-", "weight": 1.0, "n": 56, "confidence": "low", "headlineStat": "Median 138 days from private report to ZDI's public advisory (56 cases)", "group": "privateFix" }, { "key": "silence", "label": "Time to first advisory", "score": 78.0, "grade": "B", "weight": 0.0, "n": 2, "confidence": "low", "headlineStat": "2 of 2 zero-days within a day", "group": "response" }, { "key": "exposure", "label": "Time to first fix", "score": 78.0, "grade": "B", "weight": 0.0, "n": 2, "confidence": "low", "headlineStat": "2 of 2 zero-days within a day", "group": "response" }, { "key": "followThrough", "label": "Time to fix all versions", "score": 77.9, "grade": "B", "weight": 0.0, "n": 2, "confidence": "low", "headlineStat": "1 of 2 zero-days within a day, longest 4 days", "group": "response" }, { "key": "trackRecord", "label": "Exploited-bug burden", "score": 26.4, "grade": "F", "weight": 0.0, "n": 19, "confidence": "medium", "headlineStat": "8 KEV listings in 12 months, 15 in 24 months, 0 linked to ransomware", "group": "context" }, { "key": "openness", "label": "Openness", "score": 64.4, "grade": "C", "weight": 0.0, "n": 6, "confidence": "low", "headlineStat": "Advisories available by API and RSS. 2 of 2 fixed zero-days with a public fix date for every version.", "group": "response" } ], "stats": { "kev12mo": 8, "kev24mo": 15, "kevAllTime": 31, "ransomware24mo": 0, "incidents24mo": 14, "privateCases": 56, "medianPrivateFixDays": 137.5, "deadlineMissRate": 0.518, "unpatchedDisclosures": 0, "medianSilenceHours": 0.0, "medianExposureHours": 0.0, "medianFollowThroughHours": 42.5, "exploitedBeforePatchRate": 0.143, "liveUnpatched": 0 }, "medianStrip": { "vendor": 0.0, "workaround": null, "patchFirst": 0.0, "patchAll": 42.5 }, "lastIncidentAt": "2026-06-28T22:21:00Z" }, { "slug": "mozilla", "name": "Mozilla", "categories": [ "platform" ], "grade": "NR", "score": null, "scoreInterval": null, "confidence": "none", "provisional": false, "provisionalReason": null, "rank": null, "privateFix": { "grade": "B-", "score": 73.6, "scoreInterval": [ 57.3, 89.9 ], "confidence": "low", "provisional": true, "provisionalReason": "4 private reports, published on 3 dates. Not enough yet for a firm grade", "rank": 15, "n": 4 }, "trend": null, "responseN": 0, "subScores": [ { "key": "speed", "label": "Private fix speed", "score": 73.6, "grade": "B-", "weight": 1.0, "n": 4, "confidence": "low", "headlineStat": "Median 64 days from private report to fix (4 cases, 1 with a vendor fix date)", "group": "privateFix" }, { "key": "silence", "label": "Time to first advisory", "score": null, "grade": "NR", "weight": 0.0, "n": 0, "confidence": "none", "headlineStat": "No reviewed zero-days in the last 36 months", "group": "response" }, { "key": "exposure", "label": "Time to first fix", "score": null, "grade": "NR", "weight": 0.0, "n": 0, "confidence": "none", "headlineStat": "No reviewed zero-days in the last 36 months", "group": "response" }, { "key": "followThrough", "label": "Time to fix all versions", "score": null, "grade": "NR", "weight": 0.0, "n": 0, "confidence": "none", "headlineStat": "No reviewed zero-days in the last 36 months", "group": "response" }, { "key": "trackRecord", "label": "Exploited-bug burden", "score": 79.5, "grade": "B", "weight": 0.0, "n": 2, "confidence": "low", "headlineStat": "0 KEV listings in 12 months, 1 in 24 months, 0 linked to ransomware", "group": "context" }, { "key": "openness", "label": "Openness", "score": 41.7, "grade": "D-", "weight": 0.0, "n": 4, "confidence": "low", "headlineStat": "No machine-readable advisory feed listed", "group": "response" } ], "stats": { "kev12mo": 0, "kev24mo": 1, "kevAllTime": 13, "ransomware24mo": 0, "incidents24mo": 1, "privateCases": 4, "medianPrivateFixDays": 63.5, "deadlineMissRate": 0.25, "unpatchedDisclosures": 0, "medianSilenceHours": null, "medianExposureHours": null, "medianFollowThroughHours": null, "exploitedBeforePatchRate": null, "liveUnpatched": 0 }, "medianStrip": { "vendor": null, "workaround": null, "patchFirst": null, "patchAll": null }, "lastIncidentAt": "2010-10-27T22:00:00Z" }, { "slug": "n-able", "name": "N-able", "categories": [ "it-management" ], "grade": "NR", "score": null, "scoreInterval": null, "confidence": "none", "provisional": false, "provisionalReason": null, "rank": null, "privateFix": { "grade": "NR", "score": null, "scoreInterval": null, "confidence": "none", "provisional": false, "provisionalReason": null, "rank": null, "n": 0 }, "trend": null, "responseN": 2, "subScores": [ { "key": "speed", "label": "Private fix speed", "score": null, "grade": "NR", "weight": 0.0, "n": 0, "confidence": "none", "headlineStat": "No private reports in the last 36 months", "group": "privateFix" }, { "key": "silence", "label": "Time to first advisory", "score": 82.3, "grade": "B+", "weight": 0.0, "n": 2, "confidence": "low", "headlineStat": "2 of 2 zero-days within a day", "group": "response" }, { "key": "exposure", "label": "Time to first fix", "score": 80.9, "grade": "B+", "weight": 0.0, "n": 2, "confidence": "low", "headlineStat": "1 of 2 zero-days within a day, longest 5 days", "group": "response" }, { "key": "followThrough", "label": "Time to fix all versions", "score": 82.5, "grade": "B+", "weight": 0.0, "n": 2, "confidence": "low", "headlineStat": "1 of 2 zero-days within a day, longest 5 days", "group": "response" }, { "key": "trackRecord", "label": "Exploited-bug burden", "score": 51.9, "grade": "D+", "weight": 0.0, "n": 5, "confidence": "low", "headlineStat": "3 KEV listings in 12 months, 5 in 24 months, 0 linked to ransomware", "group": "context" }, { "key": "openness", "label": "Openness", "score": 65.9, "grade": "C+", "weight": 0.0, "n": 4, "confidence": "low", "headlineStat": "Advisories available by RSS. 0 of 2 zero-days with a dated revision history. 2 of 2 advisories said the bug was exploited. 2 of 2 fixed zero-days with a public fix date for every version. 1 of 1 zero-day not fixed within a day had an advisory or mitigation within 72 hours.", "group": "response" } ], "stats": { "kev12mo": 3, "kev24mo": 5, "kevAllTime": 5, "ransomware24mo": 0, "incidents24mo": 3, "privateCases": 0, "medianPrivateFixDays": null, "deadlineMissRate": null, "unpatchedDisclosures": 0, "medianSilenceHours": 0.0, "medianExposureHours": 60.0, "medianFollowThroughHours": 60.0, "exploitedBeforePatchRate": 1.0, "liveUnpatched": 0 }, "medianStrip": { "vendor": 0.0, "workaround": 24.0, "patchFirst": 60.0, "patchAll": 60.0 }, "lastIncidentAt": "2026-09-06T00:00:00Z" }, { "slug": "progress", "name": "Progress Software", "categories": [ "enterprise-apps" ], "grade": "NR", "score": null, "scoreInterval": null, "confidence": "none", "provisional": false, "provisionalReason": null, "rank": null, "privateFix": { "grade": "B", "score": 79.0, "scoreInterval": [ 71.6, 86.3 ], "confidence": "medium", "provisional": false, "provisionalReason": null, "rank": 2, "n": 21 }, "trend": null, "responseN": 0, "subScores": [ { "key": "speed", "label": "Private fix speed", "score": 79.0, "grade": "B", "weight": 1.0, "n": 21, "confidence": "medium", "headlineStat": "Median 98 days from private report to ZDI's public advisory (21 cases)", "group": "privateFix" }, { "key": "silence", "label": "Time to first advisory", "score": null, "grade": "NR", "weight": 0.0, "n": 0, "confidence": "none", "headlineStat": "No reviewed zero-days in the last 36 months", "group": "response" }, { "key": "exposure", "label": "Time to first fix", "score": null, "grade": "NR", "weight": 0.0, "n": 0, "confidence": "none", "headlineStat": "No reviewed zero-days in the last 36 months", "group": "response" }, { "key": "followThrough", "label": "Time to fix all versions", "score": null, "grade": "NR", "weight": 0.0, "n": 0, "confidence": "none", "headlineStat": "No reviewed zero-days in the last 36 months", "group": "response" }, { "key": "trackRecord", "label": "Exploited-bug burden", "score": 64.3, "grade": "C", "weight": 0.0, "n": 5, "confidence": "low", "headlineStat": "1 KEV listings in 12 months, 3 in 24 months, 0 linked to ransomware", "group": "context" }, { "key": "openness", "label": "Openness", "score": 41.7, "grade": "D-", "weight": 0.0, "n": 6, "confidence": "low", "headlineStat": "No machine-readable advisory feed listed", "group": "response" } ], "stats": { "kev12mo": 1, "kev24mo": 3, "kevAllTime": 11, "ransomware24mo": 0, "incidents24mo": 3, "privateCases": 21, "medianPrivateFixDays": 98.0, "deadlineMissRate": 0.19, "unpatchedDisclosures": 0, "medianSilenceHours": null, "medianExposureHours": null, "medianFollowThroughHours": null, "exploitedBeforePatchRate": 0.0, "liveUnpatched": 0 }, "medianStrip": { "vendor": null, "workaround": null, "patchFirst": null, "patchAll": null }, "lastIncidentAt": "2026-06-04T00:00:00Z" }, { "slug": "qnap", "name": "QNAP", "categories": [ "infrastructure" ], "grade": "NR", "score": null, "scoreInterval": null, "confidence": "none", "provisional": false, "provisionalReason": null, "rank": null, "privateFix": { "grade": "C+", "score": 65.6, "scoreInterval": [ 53.7, 77.6 ], "confidence": "low", "provisional": true, "provisionalReason": "10 private reports, published on 7 dates. Not enough yet for a firm grade", "rank": 17, "n": 10 }, "trend": null, "responseN": 0, "subScores": [ { "key": "speed", "label": "Private fix speed", "score": 65.6, "grade": "C+", "weight": 1.0, "n": 10, "confidence": "low", "headlineStat": "Median 226 days from private report to fix (10 cases, 1 with a vendor fix date)", "group": "privateFix" }, { "key": "silence", "label": "Time to first advisory", "score": null, "grade": "NR", "weight": 0.0, "n": 0, "confidence": "none", "headlineStat": "No reviewed zero-days in the last 36 months", "group": "response" }, { "key": "exposure", "label": "Time to first fix", "score": null, "grade": "NR", "weight": 0.0, "n": 0, "confidence": "none", "headlineStat": "No reviewed zero-days in the last 36 months", "group": "response" }, { "key": "followThrough", "label": "Time to fix all versions", "score": null, "grade": "NR", "weight": 0.0, "n": 0, "confidence": "none", "headlineStat": "No reviewed zero-days in the last 36 months", "group": "response" }, { "key": "trackRecord", "label": "Exploited-bug burden", "score": 96.4, "grade": "A+", "weight": 0.0, "n": 1, "confidence": "low", "headlineStat": "No KEV listings in the last 24 months", "group": "context" }, { "key": "openness", "label": "Openness", "score": 61.7, "grade": "C", "weight": 0.0, "n": 3, "confidence": "low", "headlineStat": "Advisories available by RSS", "group": "response" } ], "stats": { "kev12mo": 0, "kev24mo": 0, "kevAllTime": 12, "ransomware24mo": 0, "incidents24mo": 0, "privateCases": 10, "medianPrivateFixDays": 226.0, "deadlineMissRate": 0.8, "unpatchedDisclosures": 0, "medianSilenceHours": null, "medianExposureHours": null, "medianFollowThroughHours": null, "exploitedBeforePatchRate": null, "liveUnpatched": 0 }, "medianStrip": { "vendor": null, "workaround": null, "patchFirst": null, "patchAll": null }, "lastIncidentAt": null }, { "slug": "sap", "name": "SAP", "categories": [ "enterprise-apps" ], "grade": "NR", "score": null, "scoreInterval": null, "confidence": "none", "provisional": false, "provisionalReason": null, "rank": null, "privateFix": { "grade": "NR", "score": null, "scoreInterval": null, "confidence": "none", "provisional": false, "provisionalReason": null, "rank": null, "n": 0 }, "trend": null, "responseN": 2, "subScores": [ { "key": "speed", "label": "Private fix speed", "score": null, "grade": "NR", "weight": 0.0, "n": 0, "confidence": "none", "headlineStat": "No private reports in the last 36 months", "group": "privateFix" }, { "key": "silence", "label": "Time to first advisory", "score": 77.6, "grade": "B", "weight": 0.0, "n": 2, "confidence": "low", "headlineStat": "1 of 2 zero-days within a day, longest 2 days", "group": "response" }, { "key": "exposure", "label": "Time to first fix", "score": 78.5, "grade": "B", "weight": 0.0, "n": 2, "confidence": "low", "headlineStat": "1 of 2 zero-days within a day, longest 2 days", "group": "response" }, { "key": "followThrough", "label": "Time to fix all versions", "score": 78.8, "grade": "B", "weight": 0.0, "n": 2, "confidence": "low", "headlineStat": "1 of 2 zero-days within a day, longest 2 days", "group": "response" }, { "key": "trackRecord", "label": "Exploited-bug burden", "score": 65.2, "grade": "C+", "weight": 0.0, "n": 4, "confidence": "low", "headlineStat": "0 KEV listings in 12 months, 3 in 24 months, 2 linked to ransomware", "group": "context" }, { "key": "openness", "label": "Openness", "score": 46.7, "grade": "D", "weight": 0.0, "n": 4, "confidence": "low", "headlineStat": "No machine-readable advisory feed listed. 2 of 2 fixed zero-days with a public fix date for every version. 1 of 1 zero-day not fixed within a day had an advisory or mitigation within 72 hours.", "group": "response" } ], "stats": { "kev12mo": 0, "kev24mo": 3, "kevAllTime": 14, "ransomware24mo": 2, "incidents24mo": 3, "privateCases": 0, "medianPrivateFixDays": null, "deadlineMissRate": null, "unpatchedDisclosures": 0, "medianSilenceHours": 24.0, "medianExposureHours": 24.0, "medianFollowThroughHours": 24.0, "exploitedBeforePatchRate": 1.0, "liveUnpatched": 0 }, "medianStrip": { "vendor": 24.0, "workaround": null, "patchFirst": 24.0, "patchAll": 24.0 }, "lastIncidentAt": "2025-05-13T00:17:00Z" }, { "slug": "solarwinds", "name": "SolarWinds", "categories": [ "it-management" ], "grade": "NR", "score": null, "scoreInterval": null, "confidence": "none", "provisional": false, "provisionalReason": null, "rank": null, "privateFix": { "grade": "B-", "score": 72.8, "scoreInterval": [ 61.1, 84.4 ], "confidence": "low", "provisional": true, "provisionalReason": "18 private reports, published on 12 dates. Not enough yet for a firm grade", "rank": 12, "n": 18 }, "trend": null, "responseN": 0, "subScores": [ { "key": "speed", "label": "Private fix speed", "score": 72.8, "grade": "B-", "weight": 1.0, "n": 18, "confidence": "low", "headlineStat": "Median 132 days from private report to fix (18 cases, 2 with a vendor fix date)", "group": "privateFix" }, { "key": "silence", "label": "Time to first advisory", "score": null, "grade": "NR", "weight": 0.0, "n": 0, "confidence": "none", "headlineStat": "No reviewed zero-days in the last 36 months", "group": "response" }, { "key": "exposure", "label": "Time to first fix", "score": null, "grade": "NR", "weight": 0.0, "n": 0, "confidence": "none", "headlineStat": "No reviewed zero-days in the last 36 months", "group": "response" }, { "key": "followThrough", "label": "Time to fix all versions", "score": null, "grade": "NR", "weight": 0.0, "n": 0, "confidence": "none", "headlineStat": "No reviewed zero-days in the last 36 months", "group": "response" }, { "key": "trackRecord", "label": "Exploited-bug burden", "score": 48.9, "grade": "D", "weight": 0.0, "n": 7, "confidence": "low", "headlineStat": "4 KEV listings in 12 months, 4 in 24 months, 1 linked to ransomware", "group": "context" }, { "key": "openness", "label": "Openness", "score": 61.7, "grade": "C", "weight": 0.0, "n": 3, "confidence": "low", "headlineStat": "Advisories available by RSS", "group": "response" } ], "stats": { "kev12mo": 4, "kev24mo": 4, "kevAllTime": 11, "ransomware24mo": 1, "incidents24mo": 3, "privateCases": 18, "medianPrivateFixDays": 132.0, "deadlineMissRate": 0.5, "unpatchedDisclosures": 0, "medianSilenceHours": null, "medianExposureHours": null, "medianFollowThroughHours": null, "exploitedBeforePatchRate": 0.0, "liveUnpatched": 0 }, "medianStrip": { "vendor": null, "workaround": null, "patchFirst": null, "patchAll": null }, "lastIncidentAt": "2026-06-03T00:00:00Z" }, { "slug": "sophos", "name": "Sophos", "categories": [ "edge", "security" ], "grade": "NR", "score": null, "scoreInterval": null, "confidence": "none", "provisional": false, "provisionalReason": null, "rank": null, "privateFix": { "grade": "NR", "score": null, "scoreInterval": null, "confidence": "none", "provisional": false, "provisionalReason": null, "rank": null, "n": 0 }, "trend": null, "responseN": 0, "subScores": [ { "key": "speed", "label": "Private fix speed", "score": null, "grade": "NR", "weight": 0.0, "n": 0, "confidence": "none", "headlineStat": "No private reports in the last 36 months", "group": "privateFix" }, { "key": "silence", "label": "Time to first advisory", "score": null, "grade": "NR", "weight": 0.0, "n": 0, "confidence": "none", "headlineStat": "No reviewed zero-days in the last 36 months", "group": "response" }, { "key": "exposure", "label": "Time to first fix", "score": null, "grade": "NR", "weight": 0.0, "n": 0, "confidence": "none", "headlineStat": "No reviewed zero-days in the last 36 months", "group": "response" }, { "key": "followThrough", "label": "Time to fix all versions", "score": null, "grade": "NR", "weight": 0.0, "n": 0, "confidence": "none", "headlineStat": "No reviewed zero-days in the last 36 months", "group": "response" }, { "key": "trackRecord", "label": "Exploited-bug burden", "score": 78.3, "grade": "B", "weight": 0.0, "n": 3, "confidence": "low", "headlineStat": "0 KEV listings in 12 months, 2 in 24 months, 1 linked to ransomware", "group": "context" }, { "key": "openness", "label": "Openness", "score": 61.7, "grade": "C", "weight": 0.0, "n": 3, "confidence": "low", "headlineStat": "Advisories available by RSS", "group": "response" } ], "stats": { "kev12mo": 0, "kev24mo": 2, "kevAllTime": 7, "ransomware24mo": 1, "incidents24mo": 2, "privateCases": 0, "medianPrivateFixDays": null, "deadlineMissRate": null, "unpatchedDisclosures": 0, "medianSilenceHours": null, "medianExposureHours": null, "medianFollowThroughHours": null, "exploitedBeforePatchRate": 1.0, "liveUnpatched": 0 }, "medianStrip": { "vendor": null, "workaround": null, "patchFirst": null, "patchAll": null }, "lastIncidentAt": "2020-12-10T00:00:00Z" }, { "slug": "synology", "name": "Synology", "categories": [ "infrastructure" ], "grade": "NR", "score": null, "scoreInterval": null, "confidence": "none", "provisional": false, "provisionalReason": null, "rank": null, "privateFix": { "grade": "B-", "score": 73.6, "scoreInterval": [ 60.3, 86.9 ], "confidence": "low", "provisional": true, "provisionalReason": "6 private reports, published on 5 dates. Not enough yet for a firm grade", "rank": 14, "n": 6 }, "trend": null, "responseN": 0, "subScores": [ { "key": "speed", "label": "Private fix speed", "score": 73.6, "grade": "B-", "weight": 1.0, "n": 6, "confidence": "low", "headlineStat": "Median 38 days from private report to fix (6 cases, 5 with a vendor fix date)", "group": "privateFix" }, { "key": "silence", "label": "Time to first advisory", "score": null, "grade": "NR", "weight": 0.0, "n": 0, "confidence": "none", "headlineStat": "No reviewed zero-days in the last 36 months", "group": "response" }, { "key": "exposure", "label": "Time to first fix", "score": null, "grade": "NR", "weight": 0.0, "n": 0, "confidence": "none", "headlineStat": "No reviewed zero-days in the last 36 months", "group": "response" }, { "key": "followThrough", "label": "Time to fix all versions", "score": null, "grade": "NR", "weight": 0.0, "n": 0, "confidence": "none", "headlineStat": "No reviewed zero-days in the last 36 months", "group": "response" }, { "key": "trackRecord", "label": "Exploited-bug burden", "score": 100.0, "grade": "A+", "weight": 0.0, "n": 0, "confidence": "low", "headlineStat": "No KEV listings in the last 24 months", "group": "context" }, { "key": "openness", "label": "Openness", "score": 61.7, "grade": "C", "weight": 0.0, "n": 4, "confidence": "low", "headlineStat": "Advisories available by RSS", "group": "response" } ], "stats": { "kev12mo": 0, "kev24mo": 0, "kevAllTime": 0, "ransomware24mo": 0, "incidents24mo": 0, "privateCases": 6, "medianPrivateFixDays": 37.5, "deadlineMissRate": 0.333, "unpatchedDisclosures": 0, "medianSilenceHours": null, "medianExposureHours": null, "medianFollowThroughHours": null, "exploitedBeforePatchRate": null, "liveUnpatched": 0 }, "medianStrip": { "vendor": null, "workaround": null, "patchFirst": null, "patchAll": null }, "lastIncidentAt": null }, { "slug": "trend-micro", "name": "Trend Micro", "categories": [ "security" ], "grade": "NR", "score": null, "scoreInterval": null, "confidence": "none", "provisional": false, "provisionalReason": null, "rank": null, "privateFix": { "grade": "C", "score": 61.3, "scoreInterval": [ 53.3, 69.2 ], "confidence": "medium", "provisional": false, "provisionalReason": null, "rank": 18, "n": 65 }, "trend": null, "responseN": 2, "subScores": [ { "key": "speed", "label": "Private fix speed", "score": 61.3, "grade": "C", "weight": 1.0, "n": 65, "confidence": "medium", "headlineStat": "Median 194 days from private report to fix (65 cases, 5 with a vendor fix date)", "group": "privateFix" }, { "key": "silence", "label": "Time to first advisory", "score": 80.3, "grade": "B+", "weight": 0.0, "n": 2, "confidence": "low", "headlineStat": "2 of 2 zero-days within a day", "group": "response" }, { "key": "exposure", "label": "Time to first fix", "score": 75.5, "grade": "B", "weight": 0.0, "n": 2, "confidence": "low", "headlineStat": "1 of 2 zero-days within a day, longest 10 days", "group": "response" }, { "key": "followThrough", "label": "Time to fix all versions", "score": 79.4, "grade": "B", "weight": 0.0, "n": 2, "confidence": "low", "headlineStat": "1 of 2 zero-days within a day, longest 10 days", "group": "response" }, { "key": "trackRecord", "label": "Exploited-bug burden", "score": 76.2, "grade": "B", "weight": 0.0, "n": 2, "confidence": "low", "headlineStat": "1 KEV listings in 12 months, 2 in 24 months, 0 linked to ransomware", "group": "context" }, { "key": "openness", "label": "Openness", "score": 80.4, "grade": "B+", "weight": 0.0, "n": 5, "confidence": "low", "headlineStat": "Advisories published as CSAF. 2 of 2 zero-days with a dated revision history. 2 of 2 fixed zero-days with a public fix date for every version. 1 of 1 zero-day not fixed within a day had an advisory or mitigation within 72 hours.", "group": "response" } ], "stats": { "kev12mo": 1, "kev24mo": 2, "kevAllTime": 12, "ransomware24mo": 0, "incidents24mo": 2, "privateCases": 65, "medianPrivateFixDays": 194.0, "deadlineMissRate": 0.846, "unpatchedDisclosures": 0, "medianSilenceHours": 0.0, "medianExposureHours": 124.5, "medianFollowThroughHours": 124.5, "exploitedBeforePatchRate": 1.0, "liveUnpatched": 0 }, "medianStrip": { "vendor": 0.0, "workaround": 0.0, "patchFirst": 124.5, "patchAll": 124.5 }, "lastIncidentAt": "2026-05-21T13:00:00Z" }, { "slug": "veeam", "name": "Veeam", "categories": [ "it-management", "infrastructure" ], "grade": "NR", "score": null, "scoreInterval": null, "confidence": "none", "provisional": false, "provisionalReason": null, "rank": null, "privateFix": { "grade": "B-", "score": 73.9, "scoreInterval": [ 61.6, 86.2 ], "confidence": "low", "provisional": true, "provisionalReason": "3 private reports, published on 3 dates. Not enough yet for a firm grade", "rank": 11, "n": 3 }, "trend": null, "responseN": 0, "subScores": [ { "key": "speed", "label": "Private fix speed", "score": 73.9, "grade": "B-", "weight": 1.0, "n": 3, "confidence": "low", "headlineStat": "Median 136 days from private report to ZDI's public advisory (3 cases)", "group": "privateFix" }, { "key": "silence", "label": "Time to first advisory", "score": null, "grade": "NR", "weight": 0.0, "n": 0, "confidence": "none", "headlineStat": "No reviewed zero-days in the last 36 months", "group": "response" }, { "key": "exposure", "label": "Time to first fix", "score": null, "grade": "NR", "weight": 0.0, "n": 0, "confidence": "none", "headlineStat": "No reviewed zero-days in the last 36 months", "group": "response" }, { "key": "followThrough", "label": "Time to fix all versions", "score": null, "grade": "NR", "weight": 0.0, "n": 0, "confidence": "none", "headlineStat": "No reviewed zero-days in the last 36 months", "group": "response" }, { "key": "trackRecord", "label": "Exploited-bug burden", "score": 88.5, "grade": "A-", "weight": 0.0, "n": 1, "confidence": "low", "headlineStat": "No KEV listings in the last 24 months", "group": "context" }, { "key": "openness", "label": "Openness", "score": 61.7, "grade": "C", "weight": 0.0, "n": 4, "confidence": "low", "headlineStat": "Advisories available by RSS", "group": "response" } ], "stats": { "kev12mo": 0, "kev24mo": 0, "kevAllTime": 4, "ransomware24mo": 0, "incidents24mo": 0, "privateCases": 3, "medianPrivateFixDays": 136.0, "deadlineMissRate": 1.0, "unpatchedDisclosures": 0, "medianSilenceHours": null, "medianExposureHours": null, "medianFollowThroughHours": null, "exploitedBeforePatchRate": null, "liveUnpatched": 0 }, "medianStrip": { "vendor": null, "workaround": null, "patchFirst": null, "patchAll": null }, "lastIncidentAt": null }, { "slug": "watchguard", "name": "WatchGuard", "categories": [ "edge", "security" ], "grade": "NR", "score": null, "scoreInterval": null, "confidence": "none", "provisional": false, "provisionalReason": null, "rank": null, "privateFix": { "grade": "B-", "score": 74.9, "scoreInterval": [ 65.3, 84.5 ], "confidence": "low", "provisional": true, "provisionalReason": "5 private reports, published on 3 dates. Not enough yet for a firm grade", "rank": 7, "n": 5 }, "trend": null, "responseN": 1, "subScores": [ { "key": "speed", "label": "Private fix speed", "score": 74.9, "grade": "B-", "weight": 1.0, "n": 5, "confidence": "low", "headlineStat": "Median 119 days from private report to fix (5 cases, 3 with a vendor fix date)", "group": "privateFix" }, { "key": "silence", "label": "Time to first advisory", "score": 78.0, "grade": "B", "weight": 0.0, "n": 1, "confidence": "low", "headlineStat": "1 zero-day, within a day", "group": "response" }, { "key": "exposure", "label": "Time to first fix", "score": 78.0, "grade": "B", "weight": 0.0, "n": 1, "confidence": "low", "headlineStat": "1 zero-day, within a day", "group": "response" }, { "key": "followThrough", "label": "Time to fix all versions", "score": 78.0, "grade": "B", "weight": 0.0, "n": 1, "confidence": "low", "headlineStat": "1 zero-day, within a day", "group": "response" }, { "key": "trackRecord", "label": "Exploited-bug burden", "score": 69.9, "grade": "C+", "weight": 0.0, "n": 2, "confidence": "low", "headlineStat": "2 KEV listings in 12 months, 2 in 24 months, 1 linked to ransomware", "group": "context" }, { "key": "openness", "label": "Openness", "score": 67.2, "grade": "C+", "weight": 0.0, "n": 5, "confidence": "low", "headlineStat": "Advisories available by RSS. 1 of 1 advisories said the bug was exploited. 1 of 1 fixed zero-day with a public fix date for every version.", "group": "response" } ], "stats": { "kev12mo": 2, "kev24mo": 2, "kevAllTime": 4, "ransomware24mo": 1, "incidents24mo": 2, "privateCases": 5, "medianPrivateFixDays": 119.0, "deadlineMissRate": 0.4, "unpatchedDisclosures": 0, "medianSilenceHours": 0.0, "medianExposureHours": 0.0, "medianFollowThroughHours": 0.0, "exploitedBeforePatchRate": 0.5, "liveUnpatched": 0 }, "medianStrip": { "vendor": 0.0, "workaround": 0.0, "patchFirst": 0.0, "patchAll": 0.0 }, "lastIncidentAt": "2025-12-18T00:00:00Z" }, { "slug": "zimbra", "name": "Zimbra (Synacor)", "categories": [ "enterprise-apps" ], "grade": "NR", "score": null, "scoreInterval": null, "confidence": "none", "provisional": false, "provisionalReason": null, "rank": null, "privateFix": { "grade": "NR", "score": null, "scoreInterval": null, "confidence": "none", "provisional": false, "provisionalReason": null, "rank": null, "n": 1 }, "trend": null, "responseN": 1, "subScores": [ { "key": "speed", "label": "Private fix speed", "score": 74.9, "grade": "B-", "weight": 0.0, "n": 1, "confidence": "low", "headlineStat": "Median 128 days from private report to ZDI's public advisory (1 case)", "group": "privateFix" }, { "key": "silence", "label": "Time to first advisory", "score": 77.8, "grade": "B", "weight": 0.0, "n": 1, "confidence": "low", "headlineStat": "1 zero-day, within a day", "group": "response" }, { "key": "exposure", "label": "Time to first fix", "score": 77.8, "grade": "B", "weight": 0.0, "n": 1, "confidence": "low", "headlineStat": "1 zero-day, within a day", "group": "response" }, { "key": "followThrough", "label": "Time to fix all versions", "score": 77.8, "grade": "B", "weight": 0.0, "n": 1, "confidence": "low", "headlineStat": "1 zero-day, within a day", "group": "response" }, { "key": "trackRecord", "label": "Exploited-bug burden", "score": 41.7, "grade": "D-", "weight": 0.0, "n": 10, "confidence": "low", "headlineStat": "5 KEV listings in 12 months, 9 in 24 months, 0 linked to ransomware", "group": "context" }, { "key": "openness", "label": "Openness", "score": 63.5, "grade": "C", "weight": 0.0, "n": 4, "confidence": "low", "headlineStat": "Advisories available by RSS. 1 of 1 fixed zero-day with a public fix date for every version.", "group": "response" } ], "stats": { "kev12mo": 5, "kev24mo": 9, "kevAllTime": 19, "ransomware24mo": 0, "incidents24mo": 9, "privateCases": 1, "medianPrivateFixDays": 128.0, "deadlineMissRate": 1.0, "unpatchedDisclosures": 0, "medianSilenceHours": 0.0, "medianExposureHours": 0.0, "medianFollowThroughHours": 0.0, "exploitedBeforePatchRate": 0.125, "liveUnpatched": 0 }, "medianStrip": { "vendor": 0.0, "workaround": null, "patchFirst": 0.0, "patchAll": 0.0 }, "lastIncidentAt": "2026-07-07T00:00:00Z" }, { "slug": "zyxel", "name": "Zyxel", "categories": [ "edge" ], "grade": "NR", "score": null, "scoreInterval": null, "confidence": "none", "provisional": false, "provisionalReason": null, "rank": null, "privateFix": { "grade": "NR", "score": null, "scoreInterval": null, "confidence": "none", "provisional": false, "provisionalReason": null, "rank": null, "n": 0 }, "trend": null, "responseN": 0, "subScores": [ { "key": "speed", "label": "Private fix speed", "score": null, "grade": "NR", "weight": 0.0, "n": 0, "confidence": "none", "headlineStat": "No private reports in the last 36 months", "group": "privateFix" }, { "key": "silence", "label": "Time to first advisory", "score": null, "grade": "NR", "weight": 0.0, "n": 0, "confidence": "none", "headlineStat": "No reviewed zero-days in the last 36 months", "group": "response" }, { "key": "exposure", "label": "Time to first fix", "score": null, "grade": "NR", "weight": 0.0, "n": 0, "confidence": "none", "headlineStat": "No reviewed zero-days in the last 36 months", "group": "response" }, { "key": "followThrough", "label": "Time to fix all versions", "score": null, "grade": "NR", "weight": 0.0, "n": 0, "confidence": "none", "headlineStat": "No reviewed zero-days in the last 36 months", "group": "response" }, { "key": "trackRecord", "label": "Exploited-bug burden", "score": 64.4, "grade": "C", "weight": 0.0, "n": 4, "confidence": "low", "headlineStat": "1 KEV listings in 12 months, 4 in 24 months, 1 linked to ransomware", "group": "context" }, { "key": "openness", "label": "Openness", "score": 41.7, "grade": "D-", "weight": 0.0, "n": 2, "confidence": "low", "headlineStat": "No machine-readable advisory feed listed", "group": "response" } ], "stats": { "kev12mo": 1, "kev24mo": 4, "kevAllTime": 13, "ransomware24mo": 1, "incidents24mo": 3, "privateCases": 0, "medianPrivateFixDays": null, "deadlineMissRate": null, "unpatchedDisclosures": 0, "medianSilenceHours": null, "medianExposureHours": null, "medianFollowThroughHours": null, "exploitedBeforePatchRate": 0.333, "liveUnpatched": 0 }, "medianStrip": { "vendor": null, "workaround": null, "patchFirst": null, "patchAll": null }, "lastIncidentAt": "2026-06-16T00:00:00Z" } ]