1,596 disclosed, 97 patched. Discovery is now a capital expenditure; fixing is still one person in their own time.
A deadline is an incentive when meeting it is possible. At this volume it becomes a countdown to publishing defects nobody has fixed.
837 incidents, 419 confirmed breaches. The 418 that never became a disclosure are the sector’s real attack volume.