Five factors.
One honest answer about perimeter security.

Disclaimer and sources

Data is never fully current. Upstream databases publish, enrich and correct records with a delay of hours to weeks. NVD scoring and CPE mapping in particular lag the original disclosure, sometimes by months. Vendor advisories are revised after publication. Any view therefore reflects the state of the sources at the last data run (2026-10-17), shown on the page, and not the situation at the moment you read it. Never use this site as your only basis for patching decisions. Always consult the vendor advisory.

Period. All figures cover CVEs published between 2026-01-01 and 2026-10-17. The year is incomplete; counts and shares will change until the final run for 2026.

No warranty, no liability. riskacceptedperimeter.com is a non-commercial, independent research project. All information is provided "as is" without warranty of any kind, express or implied, including accuracy, completeness, timeliness, fitness for a particular purpose and non-infringement. To the extent permitted by law, the operator accepts no liability for any direct, indirect or consequential damage arising from the use of, or reliance on, this site, including procurement, security or investment decisions. Liability for intent and gross negligence and under mandatory statutory provisions remains unaffected.

Not an endorsement, not a security rating. Scores are statistical aggregates of public disclosure data. A low score does not mean a product is insecure, and a high score does not mean it is secure. The index measures what has been disclosed and how vendors handled it, nothing more. This site is not affiliated with, sponsored by or endorsed by any vendor listed here.

Method limits. This index shows the presence of vulnerabilities, never their absence. CVE counts reflect disclosure behaviour, research attention and CNA status as much as product quality. MTTR is a labelled proxy, not a measured notification-to-patch time. Scores are derived values with documented weightings and can change when sources are corrected or enriched retrospectively.

Feedback and complaints. Suggestions for improvement, corrections, complaints and vendor responses go to RAP@johanneskresse.com. Reported errors are reviewed and, where justified, corrected with a visible changelog entry.

Sources. All raw data comes from the public sources below. We do not alter source records; we aggregate, normalise and weight them according to the published method. Where sources contradict each other, the vendor CNA record takes precedence for affected versions and severity, NVD is the fallback, and the conflict is flagged. Source terms of use and licences apply to the underlying data.

Vendor names and trademarks belong to their respective owners and are used for identification only. Data from NVD, CISA and FIRST is public domain or published under open licences; CVE List data is used under the CVE Program terms of use; vendor pages are referenced by link only. Scores and aggregates of this site may be reused under CC BY 4.0 with attribution to Risk Accepted Perimeter. Vendors who believe a record about them is wrong can request a review at RAP@johanneskresse.com; we answer within a reasonable time and document corrections.

Legal notice (Impressum)

Liability for content. The contents of this site were created with great care. No guarantee is given for the accuracy, completeness or timeliness of the content. As a service provider we are responsible for our own content under general law; we are not obliged to monitor transmitted or stored third-party information.

Liability for links. This site contains links to external third-party websites over whose content we have no influence. The respective provider or operator is always responsible for the content of linked pages. Illegal content was not identifiable at the time of linking. Should we become aware of legal violations, such links will be removed immediately.