Vendor report cards

36 vendors, graded A+ to F on two subjects. NR means not enough evidence yet.

What a grade means. B means the vendor met the public norm, such as a first fix within 7 days of the first public report or a private fix within 120 days. Taking half the norm time scores 92, an A. Taking twice the norm time scores 43, a D−.

Rank by

Sort by

Response to exploited bugs: 10 of 36 vendors graded. 1 firm, 9 provisional, 26 not rated. A grade needs at least 3 reviewed zero-days in 36 months. Provisional grades are ranked and marked.

Vendor report cards ranked by response to exploited bugs. Each row shows both grades: response to exploited bugs and fixing privately reported bugs. Columns: rank, response grade, private-fix grade, vendor, score with interval, median response timeline, private-fix time, KEV listings in 24 months, open exploited incidents, trend.
		Response score	Compressed time scale				Trend
1	1CiscoEdge, Infrastructure	9083–96Medium confidence	Fixed within an hour Median of 14 reviewed zero-days, first fix <1hPrivate fix 113dKEV 29	113d33% over 120d	29	0	Flat
2	2SonicWallEdge, SecurityProvisional	8475–94Provisional	Fixed when disclosed Median of 4 reviewed zero-daysPrivate fix 77dKEV 9	77d29% over 120d	9	0	–
3	3CitrixEdgeProvisional	8273–92Provisional	Median of 4 reviewed zero-days, first fix 12hPrivate fix –KEV 11	–	11	0	–
4	4BeyondTrustIT management, SecurityProvisional	8171–91Provisional	Fixed when disclosed Median of 4 reviewed zero-daysPrivate fix –KEV 4	–	4	0	–
5	5IvantiEdge, IT managementProvisional	8271–92Provisional	Fixed when disclosed Median of 4 reviewed zero-daysPrivate fix 126dKEV 131 open	126d56% over 120d	13	1	–
6	6FortinetEdge, SecurityProvisional	8070–91Provisional	Median of 7 reviewed zero-days, first fix 4dPrivate fix 161dKEV 17	161d78% over 120d	17	0	–
7	7Check PointEdge, SecurityProvisional	8070–90Provisional	Fixed when disclosed Median of 3 reviewed zero-daysPrivate fix 328dKEV 4	328d100% over 120d	4	0	–
8	8Palo Alto NetworksEdge, SecurityProvisional	8069–91Provisional	Median of 3 reviewed zero-days, first fix 7.7dPrivate fix –KEV 11	–	11	0	–
9	9OracleEnterprise apps, InfrastructureProvisional	7968–90Provisional	Median of 4 reviewed zero-days, first fix 4dPrivate fix 64dKEV 10	64d28% over 120d	10	0	–
10	10MicrosoftPlatform, Enterprise appsProvisional	7563–88Provisional	Median of 3 reviewed zero-days, first fix 12dPrivate fix 140dKEV 83	140d63% over 120d	83	0	–
No response grade yet Too little evidence. Ordered by private fix rank, then A to Z.
–	ApplePlatform	1 reviewed zero-day on record. A grade needs at least 3.		105d	20	0	–
–	Progress SoftwareEnterprise apps	No reviewed zero-days yet.		98d	3	0	–
–	AdobeEnterprise apps	No reviewed zero-days yet.		89d	10	0	–
–	WatchGuardEdge, Security	1 reviewed zero-day on record. A grade needs at least 3.		119d	2	0	–
–	Broadcom (VMware)Infrastructure	2 reviewed zero-days on record. A grade needs at least 3.		70d	10	0	–
–	DockerDev tools	No reviewed zero-days yet.		111d	0	0	–
–	VeeamIT management, Infrastructure	No reviewed zero-days yet.		136d	0	0	–
–	SolarWindsIT management	No reviewed zero-days yet.		132d	4	0	–
–	Linux kernelPlatform	2 reviewed zero-days on record. A grade needs at least 3.		138d	15	0	–
–	SynologyInfrastructure	No reviewed zero-days yet.		38d	0	0	–
–	MozillaPlatform	No reviewed zero-days yet.		64d	1	0	–
–	QNAPInfrastructure	No reviewed zero-days yet.		226d	0	0	–
–	Trend MicroSecurity	2 reviewed zero-days on record. A grade needs at least 3.		194d	2	0	–
–	GooglePlatform	No reviewed zero-days yet.		299d	20	0	–
–	AtlassianEnterprise apps, Dev tools	No reviewed zero-days yet.		–	2	0	–
–	CommvaultIT management, Infrastructure	2 reviewed zero-days on record. A grade needs at least 3.		–	2	0	–
–	ConnectWiseIT management	2 reviewed zero-days on record. A grade needs at least 3.		–	3	0	–
–	CrushFTPEnterprise apps	No reviewed zero-days yet.		–	2	0	–
–	F5Edge	1 reviewed zero-day on record. A grade needs at least 3.		–	2	0	–
–	GitLabDev tools	No reviewed zero-days yet.		231d	3	0	–
–	Juniper NetworksEdge, Infrastructure	1 reviewed zero-day on record. A grade needs at least 3.		–	2	1	–
–	N-ableIT management	2 reviewed zero-days on record. A grade needs at least 3.		–	5	0	–
–	SAPEnterprise apps	2 reviewed zero-days on record. A grade needs at least 3.		–	3	0	–
–	SophosEdge, Security	No reviewed zero-days yet.		–	2	0	–
–	Zimbra (Synacor)Enterprise apps	1 reviewed zero-day on record. A grade needs at least 3.		128d	9	0	–
–	ZyxelEdge	No reviewed zero-days yet.		–	4	0	–

Vendor silent
Vendor statement, no fix
Fixed for some versions
Fixed when disclosed
Date only, no time of day

How grades work

Scores come from fixed public deadlines. One vendor's grade never moves another's.

Each grade has a likely range. A wide range means less evidence. Rank uses the low end of the range, so with equal scores, more evidence ranks higher.

Response strips use a compressed time scale. Hours and days get more room than months. Read the labels, not the bar lengths.

Firm. Enough evidence for the letter.
Provisional. Provisional Evidence is still thin, so the letter may change.
Not rated. NR (not rated) means a subject has fewer than 3 data points from the last 36 months, or their recency weights add up to less than one current data point. For response, a data point is a reviewed exploited zero-day. For private fixes, it is a private report (one vendor, one report date). KEV listings alone never rate a vendor. A grade is provisional when the vendor's own evidence does not yet outweigh the starting value, or confidence is below medium.

A+95 and up
A90 to 95
A−85 to 90
B+80 to 85
B75 to 80
B−70 to 75
C+65 to 70
C60 to 65
C−55 to 60
D+50 to 55
D45 to 50
D−40 to 45
F0 to 40