This is not a security scoreA descriptive, category-relative characterization. Never a grade, rank, score, or single number.

The Field

Vendors, plotted. Not ranked.

An all-category survey of enterprise networking & security vendors. Each is placed on a Spiegelhalter funnel by the CISA-KEV-listed fraction of the CVEs it disclosed, with control limits that widen where the data are thin, so only genuine outliers stand out.

We compare each vendor inside a product category, against the peers that do the same job. A firewall and a core router face different threats, so we do not roll a vendor’s whole catalog into one number. Every dot is one vendor in one category. Where a vendor sells a single line, that category already is its whole footprint.

Window 2022-01-01 → nowSource NVD 2.0 + CISA KEV Categories 10 Above 99.8% 4 Shodan families 15

Read the Field

Secure Remote Access / VPN · 14 vendors

Pick a category. Hover or click a point (or a Catalog row) to read its coordinates.

Network Management & Monitoring Secure Remote Access / VPN Routing & Switching NGFW / Network Security Network Detection / IDS-IPS Zero-Trust / ZTNA Identity & Access Management Application Delivery / ADC Wireless LAN SD-WAN & SASE

Within expected△ Noted (>95%)▲ Well above (>99.8%)whisker = 95% Wilson interval

This chart can only flag an unusually high exploited fraction. It never certifies a vendor as low-risk, and it cannot surface a large absolute exploited burden: a heavy discloser with many exploited edge CVEs can look unremarkable here. Select a vendor to see its Exploited burden beside the fraction.

Readout · selected

Citrix

Secure Remote Access / VPN

x · disclosed

CVEs in window

y · exploited

34.8%

8 KEV ÷ 23

▲ Well above expected

Position (leave-one-out)

Cohort expected: 4.7%
Distance (≈ SD): +6.5
95% Wilson CI: 18.8%–55.1%
Overdispersion φ: 1.09
E-value: 14.3 (CI lower 7.5) is the unmeasured-confounding strength that would nullify this flag

Above the 99.8% cohort limit, and it survives leave-one-out and grid-wide false-discovery-rate control. Its exploited fraction is inconsistent with peers given its disclosure volume. Not a security rating: a flag reflects exploitation/disclosure patterns, never proven insecurity.

Raw · always shown23 CVEs

critical8

high13

medium2

low0

KEV 8Internet-exposed 16,363 (Shodan)

Exploited burdenburden · not risk

8 known-exploited of 23 disclosed

Distinct CVEs across every category this vendor appears in, de-duplicated. A large count reflects portfolio breadth, popularity, and attacker attention, not per-unit safety. It is not ranked and is not part of the funnel. The funnel can only flag an unusually high fraction, so a heavy discloser’s large burden never shows up as a flag.

Network, no auth, no user action: 7 / 8 scored
Linked to ransomware (CISA): 3

“Network, no auth, no user action” = CVSS vector AV:N/PR:N/UI:N, the remotely-reachable pre-auth class that dominates edge-device risk. Shown of the known-exploited CVEs that carry a scored vector, since vector coverage varies by vendor.

Disclosure posturecontext · not scored

How this vendor participates in coordinated disclosure. It is excluded from every funnel statistic. More here does not mean more secure, and less does not mean less.

Own CVE Numbering Authority

Publishes CVEs directly as Citrix Systems, Inc., so it assigns and describes its own advisories.

Confirmed against the CVE Program list on 2026-07-22.

Security advisories ↗Disclosure policy ↗

View Citrix CVEs →

Secure Remote Access / VPN: per-vendor exploited fraction and raw counts over the KEV-era window.
Vendor▲	Assessment	Disclosed	KEV	Exploited %	Exposed
A10 Networks	○ Within expected	4	0	0.0%	249
Array Networks	△ Noted (above 95%)	7	2	28.6%	n/a
BeyondTrust	○ Within expected	22	3	13.6%	n/a
Check Point	○ Within expected	6	1	16.7%	77,798
Cisco	○ Within expected	114	7	6.1%	91,825
Citrix	▲ Well above expected	23	8	34.8%	16,363
F5	○ Within expected	276	5	1.8%	19,728
Fortinet	○ Within expected	239	11	4.6%	93,790
Ivanti	○ Within expected	72	5	6.9%	693
OpenVPN	○ Within expected	25	0	0.0%	n/a
Palo Alto Networks	○ Within expected	24	0	0.0%	174,594
SonicWall	○ Within expected	35	3	8.6%	120,151
Tailscale	○ Within expected	3	0	0.0%	n/a
WatchGuard	○ Within expected	44	4	9.1%	9,526

A band describes a vendor’s position within this cohort, never a grade or score. Rows default to alphabetical order so no ranking is implied; click a header to re-sort.

Exposed is the count of internet-facing instances Shodan can see for a product, shown only where we have a validated, credit-free fingerprint. That mostly means edge appliances such as firewalls, VPN gateways, and load balancers. n/a means we do not have an exposure fingerprint for that product, not that it has none, and exposure is context only: it is never part of the funnel.

How the Field is drawn

The full method, every guardrail, and the citations behind them.

◎ The funnel plot

Each vendor is one point: x is the count of CVEs it disclosed since 2022 (a precision axis, log scale, since bigger install bases disclose more, which is exposure, not insecurity), y is the exploited fraction, the share CISA lists as known-exploited[9]. The dashed line is the rate expected for the cohort[1].

▽ Why the envelope flares

A vendor with few CVEs gives a noisy rate, so the control limits widen on the left and tighten on the right. Limits are inflated for over-dispersion, because KEV listings arrive in campaign-driven batches, not independently[2], so the funnel does not over-flag.

▲ One-sided flagging + FDR

A point clears the upper 99.8% limit first (sitting below the line is never flagged), then must survive Benjamini–Hochberg false-discovery-rate control at q=0.05 across the whole vendor×category grid[5]; a candidate that fails BH is demoted to a neutral “noted” marker. Only a handful of such noted markers are expected grid-wide by chance (printed by the chart). Verdicts are qualitative bands (SSVC[7]), never a number.

⊘ Leave-one-out & Gate 2

Limits are recomputed leave-one-out. The vendor’s own numbers are excluded from the limits that judge it. Gate 2 correlates the overdispersion-adjusted residual (not the raw rate, which false-trips on small-N noise) with disclosure volume and internet exposure; if |ρ_z| ≥ 0.4 the category’s verdicts are withheld and every point renders neutral. The envelope still draws (it is public arithmetic). What we withhold is our certification, not the geometry. Per-category ρ_z is published below.

⌀ Suppression, not shrinkage

Categories with fewer than five peers are suppressed, because between-vendor dispersion is unidentifiable below that. Each point is the raw exploited fraction, not shrunk toward the group mean; a full empirical-Bayes / hierarchical treatment[4] is deliberate future work. League tables are avoided by construction[3].

◍ The exposure column

Internet-exposed-instance counts come from Shodan and are shown for context only, deliberately not the funnel denominator, since an error-laden denominator would break the funnel’s geometry. Whiskers are 95% Wilson intervals[6]. (EPSS[8] is related exploit-prediction work; we do not use it to flag anyone here.)

The mathematics, every step in the open

(1)Exploited fraction

p_i = k_i / n_i

vendor i: k_i KEV-listed of n_i CVEs disclosed since 2022‑01‑01.

(2)Cohort expected rate (leave-one-out)

θ_(−i) = ( Σ_j≠i k_j ) / ( Σ_j≠i n_j )

the pooled rate of the vendor’s peers, excluding itself.

(3)Overdispersion (winsorized method of moments)

φ = max( 1, mean( winsor_10%( z_i² ) ) )

inflates the limits because KEV listings arrive in campaign-driven batches, not i.i.d.

(4)Control limit at precision n

UCL_α(n) = θ + z_α · √φ · √( θ(1−θ) / n ), z ∈ {1.96, 3.09}

the funnel curves: the 95% and 99.8% one-sided upper limits, widening as n falls.

(5)Standardized residual (what z means in the Readout)

z_i = ( p_i − θ_(−i) ) / √( φ_(−i) · θ_(−i)(1−θ_(−i)) / n_i )

the vendor’s precision-weighted distance from what its peers predict.

(6)Gate 2: negative control (withhold if it tracks a confound)

withhold ⟺ | ρ_Spearman( z_i, log x_i ) | ≥ 0.4

x_i = disclosure volume or Shodan internet-exposure; both are tested.

(7)Multiplicity: Benjamini-Hochberg (grid-wide)

flag ⟺ p_(k) ≤ (k / m) · q, p_i = 1 − Φ(z_i), q = 0.05

across all m candidates on the vendor×category grid, so chance outliers are not published.

(8)Whisker: 95% Wilson score interval

( p̂ + z²/2n ± z√( p̂(1−p̂)/n + z²/4n² ) ) / ( 1 + z²/n )

an honest interval on a proportion at small n (unlike the naïve ±).

(9)E-value (robustness of a surviving flag)

E = RR + √( RR (RR − 1) ), RR = p_i / θ_(−i)

the unmeasured-confounding strength that would explain the flag away; E < 2 = fragile.

Definitions: p̂ = observed fraction; Φ = standard normal CDF; winsor_10% trims the residual tails so one extreme vendor cannot inflate the limits that judge it. A full hierarchical-Bayes model, a permutation-calibrated Gate 2, and a simulation-based coverage proof are the intended next refinements.

Gate-2 negative control, published for every category

Category	ρ_z vs disclosure	ρ_z vs exposure	Gate 2
Network Management & Monitoring	-0.2055	n/a	clean
Secure Remote Access / VPN	-0.3802	-0.2606	clean
Routing & Switching	-0.0868	n/a	clean
NGFW / Network Security	-0.1608	-0.8	tripped, verdicts withheld
Network Detection / IDS-IPS	0.1071	-1	tripped, verdicts withheld
Zero-Trust / ZTNA	-0.4643	-0.6	tripped, verdicts withheld
Identity & Access Management	-0.2863	n/a	clean
Application Delivery / ADC	-0.4643	-0.3714	tripped, verdicts withheld
Wireless LAN	-0.4545	n/a	tripped, verdicts withheld
SD-WAN & SASE	-0.9429	n/a	tripped, verdicts withheld

ρ_z = Spearman correlation of the overdispersion-adjusted leave-one-out residual with the log proxy. |ρ_z| ≥ 0.4 withholds the category’s verdicts. About 2 “noted” markers are expected across the grid by chance.

Disclosure posture: context, never a score

Alongside the funnel we show each vendor’s disclosure posture: whether it is a CVE Numbering Authority (CNA), an organization authorized by the CVE Program to assign and publish CVE records for its own products, and where it publishes advisories and accepts vulnerability reports.

Status is determined by an exact string match of a hand-curated official org name against the live CVE Program partner list, never a fuzzy match (which would confuse, say, “Aruba” the Italian hosting CNA with HPE Aruba). The advisory and policy links are read verbatim from each organization’s own registered entry, so every link is the vendor’s official URL and updates as the program record does. A declared name that stops matching is marked unconfirmed and left for re-verification, never auto-flipped to a negative.

This is transparency context, not a metric. It is excluded from every funnel statistic: θ, φ, the control limits, the gates, and flagging. Running a CNA is a disclosure-maturity signal, not proof of security; a vendor with more here is not “safer,” and one with less is not “more exposed.” We surface it so a low CVE count can be read in context. Few CVEs can mean a small attack surface, or simply a vendor that discloses little.

Own CVE Numbering Authority: Listed on the program roster under its own name; assigns and describes its own CVEs.
Assigns via a parent CNA: Coordinated through a parent organization’s CNA scope rather than a standalone authority.
Not a CVE Numbering Authority: Absent from the roster; CVEs are assigned by a third party (typically MITRE or a researcher’s CNA).
CNA status unconfirmed: A declared identifier could not be matched this run; shown pending re-verification, not as a finding.

Curated for 50 vendors so far; uncurated vendors simply show nothing rather than an unverified guess. Select a vendor in the Field above to see its posture in the Readout.

What this does not measure

Read this as loudly as the chart.

Not a security measure. It characterizes the exploited fraction of DISCLOSED vulnerabilities vs peers. Absence from KEV is not safety; a low fraction is not a clean bill of health.
Confounded by attention & install base. More-scrutinized, more-deployed products accrue more CVEs and KEV entries independent of their security. There is no free unbiased install-base denominator, so flags are fragile.
Gameable by disclosure policy. A vendor that discloses heavily through a mature CNA dilutes its own exploited fraction, so good hygiene can look like security.
KEV has its own selection bias. CISA KEV over-represents federal and internet-facing exploitation, so a flag can reflect a product’s role rather than its engineering.
CVSS is not risk. Per FIRST, CVSS base scores are severity, not risk, and are not comparable across vendors.
A low fraction is not a low burden. The funnel plots a fraction and can only flag an unusually high one, so a vendor that discloses heavily can carry a large absolute number of exploited, high-severity, internet-facing CVEs and still sit inside the envelope. Select a vendor to see its Exploited burden: the de-duplicated count of its known-exploited CVEs, plus how many are network-reachable with no authentication (the class that dominates edge-device risk) and how many are tied to ransomware. That burden is shown as context, never a ranking, and is not part of the funnel statistic.

Information budget

Gate 1: does each category carry enough exploitation signal to distinguish vendors? Most do not, and we say so.

Category	Vendors	Median KEV/cell	Total KEV	Budget
Secure Remote Access / VPN	14	3.0	49	thin
NGFW / Network Security	12	2.0	41	thin
Network Management & Monitoring	18	0.0	32	thin
Network Detection / IDS-IPS	7	1.0	28	thin
Zero-Trust / ZTNA	7	0.0	18	thin
Application Delivery / ADC	7	1.0	16	thin
SD-WAN & SASE	6	1.0	16	thin
Routing & Switching	11	0.0	15	thin
Identity & Access Management	18	0.0	9	thin
Wireless LAN	7	0.0	1	thin

References

[1]Spiegelhalter, D. J. (2005). Funnel plots for comparing institutional performance. Statistics in Medicine, 24(8), 1185–1202. doi.org/10.1002/sim.1970
[2]Spiegelhalter, D., et al. (2012). Statistical methods for healthcare regulation: rating, screening and surveillance. J. R. Stat. Soc. A, 175(1), 1–47. doi.org/10.1111/j.1467-985X.2011.01010.x
[3]Goldstein, H., & Spiegelhalter, D. J. (1996). League tables and their limitations. J. R. Stat. Soc. A, 159(3), 385–409. doi.org/10.2307/2983325
[4]Efron, B., & Morris, C. (1973). Stein's estimation rule and its competitors: an empirical Bayes approach. JASA, 68(341), 117–130. doi.org/10.1080/01621459.1973.10481350
[5]Benjamini, Y., & Hochberg, Y. (1995). Controlling the false discovery rate. J. R. Stat. Soc. B, 57(1), 289–300. doi.org/10.1111/j.2517-6161.1995.tb02031.x
[6]Wilson, E. B. (1927). Probable inference, the law of succession, and statistical inference. JASA, 22(158), 209–212. doi.org/10.1080/01621459.1927.10502953
[7]Spring, J., et al. (2019/2020). Prioritizing Vulnerability Response: SSVC. Carnegie Mellon University, SEI. www.sei.cmu.edu/library/prioritizing-vulnerability-response-a-stakeholder-specific-vulnerability-categorization/
[8]Jacobs, J., et al. (2020). Improving vulnerability remediation through better exploit prediction. Journal of Cybersecurity, 6(1), tyaa015. doi.org/10.1093/cybsec/tyaa015
[9]CISA. Known Exploited Vulnerabilities (KEV) Catalog. www.cisa.gov/known-exploited-vulnerabilities-catalog

Vulnerability data from the NIST NVD. Exploitation data from the CISA KEV Catalog. Data on internet-exposed instances is sourced from Shodan (shodan.io). Exposure snapshot as of 2026-07-22. Exposed-instance counts are shown for context only and are NOT used as the funnel denominator. Fingerprint mapping is approximate and under-counts hosts behind load balancers or non-standard ports.

Snapshot 2026-07-22 · method v2.0-residual-gate2-bh