The Ernst & Young study notes that RASQ’s usefulness is limited only to
comparing relative attack surface rates between Microsoft operating system
versions, because RASQ relies heavily on parameters that are only meaningful
within those operating systems. In addition, the study stressed that RASQ