@wade @briankrebs This is very interesting. What do you think is causing the jumps with Apache, Apple, and F5?
Also, the shape of the blue graph is primarily driven by a the defender company's operational practices right? Once a patch is available, a company could technically enforce immediate patching of all systems if they were interested and capable.
@Lee_Holmes @wade @briankrebs if I had to guess I'd assume it corresponds to defender team/department increases and funding increases
I find the Mozilla data very interesting, it seems they're consistently ahead of attackers despite producing a browser, which is more-or-less hit with 0day exploits and many other unknown bugs regularly?
I suppose it depends on the measurement methodology, since I guess if they patch those issues within mere hours of being told it counts as extremely good remediation? or maybe it's just a measurement of the "mozilla org" and their security rather than security of their products
@froge @Lee_Holmes @wade Reminds me of doing the patch times comparison stuff at WaPo between Mozilla and Microsoft. It wasn't even close. It's interesting that it could be the other way around this time.
@briankrebs @froge @Lee_Holmes Would def be interesting to look at a long time horizon like that. It's often hard to see forward progress in this field, but that could show investments making a difference.
