"The majority of media reports on Cenzic's survey fail to make the point that counting vulnerabilities alone is a bit pointless." quite. Disappointing to read about this report from Cenzic. Comparing publicly dislosed bugs between open and closed projects is an exercise in futility.