# Risk Accepted Perimeter

> Risk Accepted Perimeter (riskacceptedperimeter.com) is an independent, non-commercial index that ranks 24 firewall, router and VPN vendors on five factors derived from public vulnerability data for the year 2026: volume, severity, exploitation, MTTR proxy and vendor engagement. Operator: Johannes Kresse, contact RAP@johanneskresse.com.

Period: 2026-01-01 to 2026-10-17. Last data run: 2026-10-17. Scope: network products only (firewalls, routers, switches, VPN, management); consumer, endpoint and collaboration products are excluded per a published filter list. Totals: 1467 CVEs, 46 in CISA/ENISA KEV, 18 of 24 vendors are CNAs.

How to read: all factor scores and the total are 0 to 100, higher is better, rank 1 is the best vendor (least perimeter pain). Raw counts such as CVEs, KEV or pre-auth RCE are the opposite: lower is better.

Important caveats: the index shows the presence of disclosed vulnerabilities, never their absence. CVE counts reflect disclosure behaviour and research attention as much as product quality. MTTR is a proxy (vendor fix reference share, CVE reserved-to-published window, patch bypasses), not a measured disclosure-to-patch time. Vendors with fewer than 10 CVEs are flagged low data; vendors with zero CVEs in scope are not ranked. Data is never fully current; always consult the vendor advisory.

## Machine-readable data

- [vendors.json](https://riskacceptedperimeter.com/vendors.json): full dataset with scores, raw metrics, engagement evidence, monthly counts, KEV list
- [methodology.json](https://riskacceptedperimeter.com/methodology.json): factor definitions, formulas, weights, product scope, sources
- [ranking.txt](https://riskacceptedperimeter.com/ranking.txt): plain-text leaderboard
- [llms-full.txt](https://riskacceptedperimeter.com/llms-full.txt): this file plus the complete ranking and methodology text

- [changelog.json](https://riskacceptedperimeter.com/changelog.json): data run log with totals, vendors added, new KEV entries and rank movements per run

## Pages

- [Index](https://riskacceptedperimeter.com/): factors, weighting, my-perimeter calculator, quadrant chart, scorecards, leaderboard, top 10 most painful CVEs, patch-or-pray timeline, zombie index (EOL share), data run log
- [Methodology](https://riskacceptedperimeter.com/#method): how each factor is measured
- [Disclaimer and sources](https://riskacceptedperimeter.com/#disclaimer)
- [Legal notice](https://riskacceptedperimeter.com/#imprint)