objectively compare the relative security of open and closed source
products, so the report excludes raw numbers. Both sets had at
least 2500 vulnerabilities. There are too many variations in vendor
advisory release policies, possible differences in research