There&#x27;s more than process going on here; there&#x27;s also a policy axis in this graph.<p>Closed source has no obligation to reveal vulnerabilities, fix anything, or even work with customers who report vulnerabilities. ORCL will sue you [1] if you learn too much about what you bought. It&#x27;s often more in their interest to fix something after public discovery for PR reasons but leave it on the todo list otherwise.<p>So yes, of course closed and open source have holes. The question is, will they be found, announced, and addressed or will they lay secret for years behind a legal wall?<p>1. <a href="http:&#x2F;&#x2F;arstechnica.com&#x2F;information-technology&#x2F;2015&#x2F;08&#x2F;oracle-security-chief-to-customers-stop-checking-our-code-for-vulnerabilities&#x2F;" rel="nofollow">http:&#x2F;&#x2F;arstechnica.com&#x2F;information-technology&#x2F;2015&#x2F;08&#x2F;oracle...</a>