{
    "name": "Risk Accepted Perimeter methodology",
    "version": "2.4.0",
    "generated": "2026-10-17",
    "period": {
        "start": "2026-01-01",
        "end": "2026-10-17"
    },
    "reading": "All factor scores and the total are 0 to 100, higher is better (less perimeter pain). Rank #1 is the best position. This is a positive scale, not a pain scale: a vendor at the top has the least pain. Raw columns CVEs, Critical/High, pre-auth RCE, auth bypass, KEV, EPSS, patch bypass: lower is better. Fix reference share: higher is better. Coordination days: shorter is better.",
    "composite": "total = sum(score_i x weight_i) / sum(weight_i) over factors with data; users can change weights interactively, default 10/25/25/25/15.",
    "painPoints": "Top 10 list (negative, higher = worse): pain = 40 x KEV + 15 x ransomware + 20 x preAuthRce + 10 x authBypass + 3 x CVSS + min(20, 100 x EPSS) + 5 x EOL.",
    "zombieIndex": "Share of a vendor's 2026 CVEs whose description marks the product as end-of-life, out of support or will-not-fix (negative, higher = worse). Does not feed the composite score.",
    "myPerimeter": "Client-side only: mean of the selected vendors' totals under the current weighting, compared with the mean of all ranked vendors.",
    "lowDataRule": "Vendors with fewer than 10 in-scope CVEs are ranked but flagged low data. Vendors with 0 in-scope CVEs are shown but not ranked.",
    "factors": [
        {
            "key": "volume",
            "label": "Volume",
            "defaultWeight": 10,
            "direction": "higher score = fewer CVEs",
            "formula": "score = 100 x (1 - ln(1 + n) / ln(301)), n = CVEs published 2026-01-01 to data run for in-scope network products, taken from CVE List V5 affected.vendor/product. Vendors with fewer than 10 CVEs get a neutral 50 so that silence or a small installed base is not rewarded."
        },
        {
            "key": "severity",
            "label": "Severity",
            "defaultWeight": 25,
            "direction": "higher score = less severe",
            "formula": "score = 100 - 0.45 x share Critical+High (%) - min(35, 200 x pre-auth RCE share) - min(25, 150 x remote auth bypass share). CVSS from CNA metric (v4.0 preferred, else v3.x), NVD as fallback. Pre-auth RCE = AV:N and PR:N and RCE pattern/CWE and high impact. Auth bypass = authentication/authorization bypass pattern or CWE-287/288/306/798 etc. with AV:N."
        },
        {
            "key": "exploitation",
            "label": "Exploitation",
            "defaultWeight": 25,
            "direction": "higher score = less exploited",
            "formula": "score = 100 - 3 x KEV share (%) - 150 x mean EPSS - 5 x CVEs with known ransomware use. KEV = union of CISA KEV and ENISA EUVD KEV dump. EPSS = FIRST daily bulk file at data run."
        },
        {
            "key": "mttr",
            "label": "MTTR (proxy)",
            "defaultWeight": 25,
            "direction": "higher score = faster, more complete fixes",
            "formula": "PROXY, clearly labelled: score = fixRef x (0.5 + 0.5 x coord) - min(20, 100 x workaround-only share) - min(20, 100 x patch-bypass share), where fixRef = share of CVEs with a vendor fix or advisory reference (%) and coord = 1 - min(1, median days CVE reserved to published / 120). Real disclosure-to-patch times are not available in public databases; most vendors publish CVE and fix on the same day, so the reserved-to-published window measures the coordination period and the fix-reference share measures whether a fix existed at disclosure. Patch bypass = description references an incomplete or bypassed earlier fix."
        },
        {
            "key": "engagement",
            "label": "Engagement",
            "defaultWeight": 15,
            "direction": "higher score = more verifiable engagement",
            "formula": "Weighted checklist of verifiable criteria only: CNA (3.0) = vendor assigns its own CVE IDs in 2026 records; CSAF/API (1.5) = CSAF provider-metadata or documented JSON/CSAF API; disclosure policy (1.0) = public PSIRT policy page or security.txt; bug bounty (1.0) = paid programme covering products, public or private, documented by vendor or platform; Secure by Design pledge (1.0) = listed on CISA signers page. Score = achieved / 7.5 x 100."
        }
    ],
    "engagementCriteria": [
        {
            "key": "cna",
            "label": "CNA",
            "weight": 3
        },
        {
            "key": "csaf",
            "label": "CSAF/API",
            "weight": 1.5
        },
        {
            "key": "policy",
            "label": "Disclosure policy",
            "weight": 1
        },
        {
            "key": "bounty",
            "label": "Bug bounty",
            "weight": 1
        },
        {
            "key": "pledge",
            "label": "SbD pledge",
            "weight": 1
        }
    ],
    "scope": {
        "Cisco": {
            "included": "Secure Firewall ASA/FTD/FMC, IOS, IOS XE, IOS XR, NX-OS, Catalyst SD-WAN, Meraki, ISE, Snort/UTD, RV routers, Catalyst and Nexus platforms, wireless, VPN clients",
            "excluded": "Webex, RoomOS, Unity Connection, UCS, Secure Endpoint, Secure Email, Unified CM, Duo, AppDynamics, Smart Licensing"
        },
        "Fortinet": {
            "included": "FortiOS, FortiProxy, FortiManager, FortiAnalyzer, FortiSwitch, FortiAP, FortiWeb, FortiADC, FortiNAC, FortiClient, FortiExtender, FortiAuthenticator",
            "excluded": "FortiSandbox, FortiSOAR, FortiSIEM, FortiPAM, FortiDeceptor, FortiNDR, FortiMail, FortiClient EMS, FortiEDR"
        },
        "Palo Alto Networks": {
            "included": "PAN-OS, Panorama, Cloud NGFW, Prisma Access, GlobalProtect, Prisma SD-WAN ION, PA/VM series",
            "excluded": "Cortex, Prisma Browser, Prisma Cloud, Checkov, Conjur, Idira, Trust Protection Foundation"
        },
        "Ivanti": {
            "included": "Connect Secure, Policy Secure, Secure Access Client, Sentry, Virtual Traffic Manager, Neurons for ZTA, Cloud Services Appliance",
            "excluded": "Endpoint Manager, EPMM, Xtraction, Neurons for ITSM, Patch"
        },
        "Juniper Networks": {
            "included": "All (Junos OS, Junos OS Evolved, Junos Space, CTP, JSI)",
            "excluded": "none"
        },
        "Huawei": {
            "included": "USG, Eudemon, AR/NE routers, CloudEngine, S series switches, iMaster NCE, AirEngine, HiSecEngine",
            "excluded": "HarmonyOS, EMUI, consumer devices, openBMC, cloud"
        },
        "Nokia": {
            "included": "All (NSP, WaveSuite, SR OS)",
            "excluded": "none"
        },
        "Arista Networks": {
            "included": "All (EOS, CloudVision, Wi-Fi APs, NGFW, VeloCloud)",
            "excluded": "none"
        },
        "MikroTik": {
            "included": "RouterOS, Cloud Hosted Router, SwOS, WinBox",
            "excluded": "third-party hotspot software"
        },
        "Ubiquiti": {
            "included": "UniFi Network, Dream Machines/Routers, Cloud Gateways, Cloud Keys, Enterprise Fortress Gateway, Express, EdgeMax, airMAX, UniFi OS Server",
            "excluded": "UniFi Protect, NVR, NAS, Access, Talk, Connect, Play"
        },
        "TP-Link": {
            "included": "Archer, TL-, ER/Omada, Deco, EAP, DR, Festa, range extenders, switches",
            "excluded": "Tapo, Kasa, VIGI cameras, smart home"
        },
        "Netgear": {
            "included": "All routers, Orbi, Nighthawk, switches, extenders",
            "excluded": "ReadyNAS, Arlo, Meural"
        },
        "D-Link": {
            "included": "DIR, DSL, DWR, DAP, DGS, DES, DSR, DWL, COVR, EXO, Eagle Pro, Aquila Pro",
            "excluded": "DNS/DNR storage, DCS cameras, adapters"
        },
        "AVM (FRITZ!)": {
            "included": "FRITZ!Box, FRITZ!Repeater, FRITZ!OS",
            "excluded": "unrelated records matching the string AVM"
        },
        "Linksys": {
            "included": "All (routers, Velop, extenders)",
            "excluded": "none"
        },
        "SonicWall": {
            "included": "SonicOS, TZ/NSa/NSsp/NSv, SMA, NSM, GMS, NetExtender, Global VPN Client, switches, SonicWave",
            "excluded": "Email Security, Capture Client"
        },
        "Zyxel": {
            "included": "All (firewalls, CPE, APs, switches, extenders)",
            "excluded": "none"
        },
        "Check Point": {
            "included": "Quantum Security Gateway, Gaia, Quantum Spark, Security Management, Multi-Domain, Harmony SASE, Mobile Access, VPN clients",
            "excluded": "Harmony Endpoint, Harmony Email, Harmony Mobile, CloudGuard posture, ZoneAlarm"
        },
        "Sophos": {
            "included": "Sophos Firewall, XG/XGS, SG UTM, Sophos Connect, switches, APs, ZTNA",
            "excluded": "Endpoint, Intercept X, Home, Mobile, Email, MDR/XDR"
        }
    },
    "sources": [
        {
            "name": "NIST National Vulnerability Database, 2026 data feed and API 2.0",
            "usedFor": "NVD CVSS where no CNA score exists, CPE cross-check",
            "url": "https://nvd.nist.gov/vuln/data-feeds"
        },
        {
            "name": "CVE Program, CVE List V5 (GitHub mirror)",
            "usedFor": "Authoritative CVE records: affected vendor and product, CNA CVSS, CWE, dates reserved and published, reference tags, assigning CNA",
            "url": "https://github.com/CVEProject/cvelistV5"
        },
        {
            "name": "CVE Program, CNA partner list",
            "usedFor": "Cross-check of CNA status",
            "url": "https://www.cve.org/PartnerInformation/ListofPartners"
        },
        {
            "name": "ENISA European Vulnerability Database, KEV dump",
            "usedFor": "EU known exploited vulnerabilities, merged with CISA KEV",
            "url": "https://euvdservices.enisa.europa.eu/api/kev/dump"
        },
        {
            "name": "CISA Known Exploited Vulnerabilities catalog (JSON feed)",
            "usedFor": "Active exploitation, KEV dates, ransomware use",
            "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
        },
        {
            "name": "FIRST EPSS, daily bulk scores",
            "usedFor": "Exploit probability per CVE",
            "url": "https://www.first.org/epss/data"
        },
        {
            "name": "BSI CSAF aggregator",
            "usedFor": "Verification of CSAF providers",
            "url": "https://wid.cert-bund.de/.well-known/csaf-aggregator/aggregator.json"
        },
        {
            "name": "CISA Secure by Design pledge signers",
            "usedFor": "Engagement criterion pledge",
            "url": "https://www.cisa.gov/secure-design-pledge-signers"
        },
        {
            "name": "HackerOne and Bugcrowd programme pages, vendor bounty policies",
            "usedFor": "Engagement criterion bug bounty",
            "url": "https://hackerone.com/"
        },
        {
            "name": "Cisco PSIRT openVuln API and advisories",
            "usedFor": "CSAF/API check, disclosure policy",
            "url": "https://developer.cisco.com/docs/psirt/"
        },
        {
            "name": "Fortinet PSIRT (FortiGuard)",
            "usedFor": "Disclosure policy, RSS feed",
            "url": "https://www.fortiguard.com/psirt"
        },
        {
            "name": "Palo Alto Networks Security Advisories (JSON and CSAF)",
            "usedFor": "CSAF/API check, disclosure policy, bounty",
            "url": "https://security.paloaltonetworks.com/json"
        },
        {
            "name": "Ivanti Security Advisories and bug bounty policy",
            "usedFor": "Disclosure policy, bounty",
            "url": "https://www.ivanti.com/support/contact-security"
        },
        {
            "name": "Juniper SIRT",
            "usedFor": "Disclosure policy",
            "url": "https://support.juniper.net/support/security/report-a-vulnerability/"
        },
        {
            "name": "Huawei PSIRT (CSAF provider)",
            "usedFor": "CSAF check, disclosure policy, bounty",
            "url": "https://www.huawei.com/en/psirt"
        },
        {
            "name": "Nokia Product Security (CSAF provider)",
            "usedFor": "CSAF check, disclosure policy",
            "url": "https://www.nokia.com/about-us/security-and-privacy/product-security-advisory/"
        },
        {
            "name": "Arista Product Security",
            "usedFor": "Disclosure policy",
            "url": "https://www.arista.com/en/support/product-security-vulnerability-reporting"
        },
        {
            "name": "MikroTik security announcements",
            "usedFor": "Disclosure policy",
            "url": "https://mikrotik.com/supportsec"
        },
        {
            "name": "Ubiquiti security page and HackerOne programme",
            "usedFor": "Disclosure policy, bounty",
            "url": "https://ui.com/security/"
        },
        {
            "name": "TP-Link product security",
            "usedFor": "Disclosure policy, bounty statement",
            "url": "https://www.tp-link.com/us/product-security/"
        },
        {
            "name": "Netgear security page and Bugcrowd programme",
            "usedFor": "Disclosure policy, bounty",
            "url": "https://www.netgear.com/about/security/"
        },
        {
            "name": "D-Link security announcements",
            "usedFor": "Disclosure policy",
            "url": "https://supportannouncement.us.dlink.com/security/"
        },
        {
            "name": "AVM security information",
            "usedFor": "Disclosure policy",
            "url": "https://avm.de/sicherheit/"
        },
        {
            "name": "Linksys security page",
            "usedFor": "Disclosure policy",
            "url": "https://www.linksys.com/pages/security"
        },
        {
            "name": "SonicWall PSIRT",
            "usedFor": "Disclosure policy",
            "url": "https://www.sonicwall.com/support/product-security-incident-response-team"
        },
        {
            "name": "Zyxel security advisories and reporting policy",
            "usedFor": "Disclosure policy",
            "url": "https://www.zyxel.com/global/en/support/security-advisories"
        },
        {
            "name": "Check Point report security issue and bounty policy",
            "usedFor": "Disclosure policy, bounty scope",
            "url": "https://www.checkpoint.com/about-us/report-security-issue/"
        },
        {
            "name": "Sophos responsible disclosure policy and Bugcrowd programme",
            "usedFor": "Disclosure policy, bounty",
            "url": "https://www.sophos.com/en-us/legal/sophos-responsible-disclosure-policy"
        }
    ],
    "contact": "RAP@johanneskresse.com",
    "license": "Scores and aggregates: CC BY 4.0. Underlying records belong to their sources (NVD, CVE Program, CISA, ENISA, FIRST, vendor PSIRTs)."
}