Another thing that would add more information to the picture is something like &quot;percent of installbase running vulnerable version.&quot;<p>If, for example, researchers found 10k vulnerabilities in windows 3.1, it wouldn&#x27;t make sense to ding microsoft for an insecure operating system, because no one runs that and it&#x27;s not reasonable to expect support.