Microsoft

Response to exploited bugs: sub-scores

• Time to first advisory3 of 3 zero-days within a day
  82B+
  3 cases, low confidence, weight 20%
• Time to first fix1 of 3 zero-days within a day, longest 26 days
  68C+
  3 cases, low confidence, weight 40%
• Time to fix all versions1 of 3 zero-days within a day, longest 26 days
  77B
  3 cases, low confidence, weight 30%
• OpennessAdvisories published as CSAF. 3 of 3 zero-days with a dated revision history. 3 of 3 advisories said the bug was exploited. 3 of 3 fixed zero-days with a public fix date for every version. 2 of 2 zero-days not fixed within a day had an advisory or mitigation within 72 hours.
  89A−
  11 cases, medium confidence, weight 10%

Fixing privately reported bugs: sub-score

• Private fix speedMedian 140 days from private report to fix (112 cases, 24 with a vendor fix date, 32 published without a fix)
  63C
  112 cases, low confidence, weight 100%