On average, the Windows setup had just over 30 days of risk versus 71 days for the Red Hat setup, their study found


It seems they are referring to vulnerabilities announced to patch release.

Crock'o'shit.

As before, it did not rate the vulnerability severity. When Linux vulnerabilities are announced, it is typically from people trolling through the source and noticing some that COULD be leveraged. Sometime a proof follows, sometimes not.

When MS vulnerabilities are announced, it is typically from people noticing that people already are breaking into their systems, which means it has been vulnerable FAR longer, they just don't want to admit it.

Or have I misread their core premise?