Experts are particularly critical of Secunia's latest report, which was released in early February, providing valuable information about last year's vulnerabilities.
The “Secunia Vulnerability Review 2014” report allegedly includes statistics that are incorrect or questionable, experts point out.
According to an extensive article published on the OSVDB (Open Source Vulnerability Database) blog, the methodology used by Secunia to calculate the total number of vulnerabilities is incorrect, as the company does not count CVE identifiers, but relies on the number of vulnerabilities reported through the advisory notices of the respective companies.
The number of vulnerabilities , however, is not determined through public warnings, so it is practically impossible for this method to produce realistic results.
Moreover, as Secunia admits, an advisory may concern several products from a company, and multiple advisories may cover the same vulnerability, making the research results unreliable.
The full report on the Secunia research findings disputed by experts is available on the OSVDB blog.
