This is not a security scoreA descriptive, category-relative characterization. Never a grade, rank, score, or single number.

The Field

Vendors, plotted. Not ranked.

An all-category survey of enterprise networking & security vendors. Each is placed on a Spiegelhalter funnel by the CISA-KEV-listed fraction of the CVEs it disclosed, with control limits that widen where the data are thin, so only genuine outliers stand out.

We compare each vendor inside a product category, against the peers that do the same job. A firewall and a core router face different threats, so we do not roll a vendor’s whole catalog into one number. Every dot is one vendor in one category. Where a vendor sells a single line, that category already is its whole footprint.

Window 2022-01-01 → nowSource NVD 2.0 + CISA KEV Categories 10 Above 99.8% 4 Shodan families 15

Read the Field

Routing & Switching · 11 vendors

Pick a category. Hover or click a point (or a Catalog row) to read its coordinates.

Network Management & Monitoring Secure Remote Access / VPN Routing & Switching NGFW / Network Security Network Detection / IDS-IPS Zero-Trust / ZTNA Identity & Access Management Application Delivery / ADC Wireless LAN SD-WAN & SASE

Within expected△ Noted (>95%)▲ Well above (>99.8%)whisker = 95% Wilson interval

This chart can only flag an unusually high exploited fraction. It never certifies a vendor as low-risk, and it cannot surface a large absolute exploited burden: a heavy discloser with many exploited edge CVEs can look unremarkable here. Select a vendor to see its Exploited burden beside the fraction.

Readout

Select a point in the Field, or a row in the Catalog, to read its coordinates. Most vendors sit quietly inside the envelope; that is the expected result, shown honestly rather than ranked.

Routing & Switching: per-vendor exploited fraction and raw counts over the KEV-era window.
Vendor▲	Assessment	Disclosed	KEV	Exploited %	Exposed
Arista	○ Within expected	18	1	5.6%	n/a
Broadcom	○ Within expected	54	1	1.9%	n/a
Brocade	○ Within expected	5	0	0.0%	n/a
Cisco	△ Noted (above 95%)	181	7	3.9%	n/a
Dell	○ Within expected	34	0	0.0%	n/a
Extreme Networks	○ Within expected	2	0	0.0%	n/a
Fortinet	○ Within expected	9	0	0.0%	n/a
Juniper	○ Within expected	442	6	1.4%	n/a
MikroTik	○ Within expected	2	0	0.0%	170,405
NVIDIA Networking	○ Within expected	13	0	0.0%	n/a
Ubiquiti	○ Within expected	10	0	0.0%	n/a

A band describes a vendor’s position within this cohort, never a grade or score. Rows default to alphabetical order so no ranking is implied; click a header to re-sort.

Exposed is the count of internet-facing instances Shodan can see for a product, shown only where we have a validated, credit-free fingerprint. That mostly means edge appliances such as firewalls, VPN gateways, and load balancers. n/a means we do not have an exposure fingerprint for that product, not that it has none, and exposure is context only: it is never part of the funnel.

How the Field is drawn

The full method, every guardrail, and the citations behind them.

◎ The funnel plot

Each vendor is one point: x is the count of CVEs it disclosed since 2022 (a precision axis, log scale, since bigger install bases disclose more, which is exposure, not insecurity), y is the exploited fraction, the share CISA lists as known-exploited[9]. The dashed line is the rate expected for the cohort[1].

▽ Why the envelope flares

A vendor with few CVEs gives a noisy rate, so the control limits widen on the left and tighten on the right. Limits are inflated for over-dispersion, because KEV listings arrive in campaign-driven batches, not independently[2], so the funnel does not over-flag.

▲ One-sided flagging + FDR

A point clears the upper 99.8% limit first (sitting below the line is never flagged), then must survive Benjamini–Hochberg false-discovery-rate control at q=0.05 across the whole vendor×category grid[5]; a candidate that fails BH is demoted to a neutral “noted” marker. Only a handful of such noted markers are expected grid-wide by chance (printed by the chart). Verdicts are qualitative bands (SSVC[7]), never a number.

⊘ Leave-one-out & Gate 2

Limits are recomputed leave-one-out. The vendor’s own numbers are excluded from the limits that judge it. Gate 2 correlates the overdispersion-adjusted residual (not the raw rate, which false-trips on small-N noise) with disclosure volume and internet exposure; if |ρ_z| ≥ 0.4 the category’s verdicts are withheld and every point renders neutral. The envelope still draws (it is public arithmetic). What we withhold is our certification, not the geometry. Per-category ρ_z is published below.

⌀ Suppression, not shrinkage

Categories with fewer than five peers are suppressed, because between-vendor dispersion is unidentifiable below that. Each point is the raw exploited fraction, not shrunk toward the group mean; a full empirical-Bayes / hierarchical treatment[4] is deliberate future work. League tables are avoided by construction[3].

◍ The exposure column

Internet-exposed-instance counts come from Shodan and are shown for context only, deliberately not the funnel denominator, since an error-laden denominator would break the funnel’s geometry. Whiskers are 95% Wilson intervals[6]. (EPSS[8] is related exploit-prediction work; we do not use it to flag anyone here.)

The mathematics, every step in the open

(1)Exploited fraction

p_i = k_i / n_i

vendor i: k_i KEV-listed of n_i CVEs disclosed since 2022‑01‑01.

(2)Cohort expected rate (leave-one-out)

θ_(−i) = ( Σ_j≠i k_j ) / ( Σ_j≠i n_j )

the pooled rate of the vendor’s peers, excluding itself.

(3)Overdispersion (winsorized method of moments)

φ = max( 1, mean( winsor_10%( z_i² ) ) )

inflates the limits because KEV listings arrive in campaign-driven batches, not i.i.d.

(4)Control limit at precision n

UCL_α(n) = θ + z_α · √φ · √( θ(1−θ) / n ), z ∈ {1.96, 3.09}

the funnel curves: the 95% and 99.8% one-sided upper limits, widening as n falls.

(5)Standardized residual (what z means in the Readout)

z_i = ( p_i − θ_(−i) ) / √( φ_(−i) · θ_(−i)(1−θ_(−i)) / n_i )

the vendor’s precision-weighted distance from what its peers predict.

(6)Gate 2: negative control (withhold if it tracks a confound)

withhold ⟺ | ρ_Spearman( z_i, log x_i ) | ≥ 0.4

x_i = disclosure volume or Shodan internet-exposure; both are tested.

(7)Multiplicity: Benjamini-Hochberg (grid-wide)

flag ⟺ p_(k) ≤ (k / m) · q, p_i = 1 − Φ(z_i), q = 0.05

across all m candidates on the vendor×category grid, so chance outliers are not published.

(8)Whisker: 95% Wilson score interval

( p̂ + z²/2n ± z√( p̂(1−p̂)/n + z²/4n² ) ) / ( 1 + z²/n )

an honest interval on a proportion at small n (unlike the naïve ±).

(9)E-value (robustness of a surviving flag)

E = RR + √( RR (RR − 1) ), RR = p_i / θ_(−i)

the unmeasured-confounding strength that would explain the flag away; E < 2 = fragile.

Definitions: p̂ = observed fraction; Φ = standard normal CDF; winsor_10% trims the residual tails so one extreme vendor cannot inflate the limits that judge it. A full hierarchical-Bayes model, a permutation-calibrated Gate 2, and a simulation-based coverage proof are the intended next refinements.

Gate-2 negative control, published for every category

Category	ρ_z vs disclosure	ρ_z vs exposure	Gate 2
Network Management & Monitoring	-0.2055	n/a	clean
Secure Remote Access / VPN	-0.3802	-0.2606	clean
Routing & Switching	-0.0868	n/a	clean
NGFW / Network Security	-0.1608	-0.8	tripped, verdicts withheld
Network Detection / IDS-IPS	0.1071	-1	tripped, verdicts withheld
Zero-Trust / ZTNA	-0.4643	-0.6	tripped, verdicts withheld
Identity & Access Management	-0.2863	n/a	clean
Application Delivery / ADC	-0.4643	-0.3714	tripped, verdicts withheld
Wireless LAN	-0.4545	n/a	tripped, verdicts withheld
SD-WAN & SASE	-0.9429	n/a	tripped, verdicts withheld

ρ_z = Spearman correlation of the overdispersion-adjusted leave-one-out residual with the log proxy. |ρ_z| ≥ 0.4 withholds the category’s verdicts. About 2 “noted” markers are expected across the grid by chance.

Disclosure posture: context, never a score

Alongside the funnel we show each vendor’s disclosure posture: whether it is a CVE Numbering Authority (CNA), an organization authorized by the CVE Program to assign and publish CVE records for its own products, and where it publishes advisories and accepts vulnerability reports.

Status is determined by an exact string match of a hand-curated official org name against the live CVE Program partner list, never a fuzzy match (which would confuse, say, “Aruba” the Italian hosting CNA with HPE Aruba). The advisory and policy links are read verbatim from each organization’s own registered entry, so every link is the vendor’s official URL and updates as the program record does. A declared name that stops matching is marked unconfirmed and left for re-verification, never auto-flipped to a negative.

This is transparency context, not a metric. It is excluded from every funnel statistic: θ, φ, the control limits, the gates, and flagging. Running a CNA is a disclosure-maturity signal, not proof of security; a vendor with more here is not “safer,” and one with less is not “more exposed.” We surface it so a low CVE count can be read in context. Few CVEs can mean a small attack surface, or simply a vendor that discloses little.

Own CVE Numbering Authority: Listed on the program roster under its own name; assigns and describes its own CVEs.
Assigns via a parent CNA: Coordinated through a parent organization’s CNA scope rather than a standalone authority.
Not a CVE Numbering Authority: Absent from the roster; CVEs are assigned by a third party (typically MITRE or a researcher’s CNA).
CNA status unconfirmed: A declared identifier could not be matched this run; shown pending re-verification, not as a finding.

Curated for 50 vendors so far; uncurated vendors simply show nothing rather than an unverified guess. Select a vendor in the Field above to see its posture in the Readout.

What this does not measure

Read this as loudly as the chart.

Not a security measure. It characterizes the exploited fraction of DISCLOSED vulnerabilities vs peers. Absence from KEV is not safety; a low fraction is not a clean bill of health.
Confounded by attention & install base. More-scrutinized, more-deployed products accrue more CVEs and KEV entries independent of their security. There is no free unbiased install-base denominator, so flags are fragile.
Gameable by disclosure policy. A vendor that discloses heavily through a mature CNA dilutes its own exploited fraction, so good hygiene can look like security.
KEV has its own selection bias. CISA KEV over-represents federal and internet-facing exploitation, so a flag can reflect a product’s role rather than its engineering.
CVSS is not risk. Per FIRST, CVSS base scores are severity, not risk, and are not comparable across vendors.
A low fraction is not a low burden. The funnel plots a fraction and can only flag an unusually high one, so a vendor that discloses heavily can carry a large absolute number of exploited, high-severity, internet-facing CVEs and still sit inside the envelope. Select a vendor to see its Exploited burden: the de-duplicated count of its known-exploited CVEs, plus how many are network-reachable with no authentication (the class that dominates edge-device risk) and how many are tied to ransomware. That burden is shown as context, never a ranking, and is not part of the funnel statistic.

Information budget

Gate 1: does each category carry enough exploitation signal to distinguish vendors? Most do not, and we say so.

Category	Vendors	Median KEV/cell	Total KEV	Budget
Secure Remote Access / VPN	14	3.0	49	thin
NGFW / Network Security	12	2.0	41	thin
Network Management & Monitoring	18	0.0	32	thin
Network Detection / IDS-IPS	7	1.0	28	thin
Zero-Trust / ZTNA	7	0.0	18	thin
Application Delivery / ADC	7	1.0	16	thin
SD-WAN & SASE	6	1.0	16	thin
Routing & Switching	11	0.0	15	thin
Identity & Access Management	18	0.0	9	thin
Wireless LAN	7	0.0	1	thin

References

[1]Spiegelhalter, D. J. (2005). Funnel plots for comparing institutional performance. Statistics in Medicine, 24(8), 1185–1202. doi.org/10.1002/sim.1970
[2]Spiegelhalter, D., et al. (2012). Statistical methods for healthcare regulation: rating, screening and surveillance. J. R. Stat. Soc. A, 175(1), 1–47. doi.org/10.1111/j.1467-985X.2011.01010.x
[3]Goldstein, H., & Spiegelhalter, D. J. (1996). League tables and their limitations. J. R. Stat. Soc. A, 159(3), 385–409. doi.org/10.2307/2983325
[4]Efron, B., & Morris, C. (1973). Stein's estimation rule and its competitors: an empirical Bayes approach. JASA, 68(341), 117–130. doi.org/10.1080/01621459.1973.10481350
[5]Benjamini, Y., & Hochberg, Y. (1995). Controlling the false discovery rate. J. R. Stat. Soc. B, 57(1), 289–300. doi.org/10.1111/j.2517-6161.1995.tb02031.x
[6]Wilson, E. B. (1927). Probable inference, the law of succession, and statistical inference. JASA, 22(158), 209–212. doi.org/10.1080/01621459.1927.10502953
[7]Spring, J., et al. (2019/2020). Prioritizing Vulnerability Response: SSVC. Carnegie Mellon University, SEI. www.sei.cmu.edu/library/prioritizing-vulnerability-response-a-stakeholder-specific-vulnerability-categorization/
[8]Jacobs, J., et al. (2020). Improving vulnerability remediation through better exploit prediction. Journal of Cybersecurity, 6(1), tyaa015. doi.org/10.1093/cybsec/tyaa015
[9]CISA. Known Exploited Vulnerabilities (KEV) Catalog. www.cisa.gov/known-exploited-vulnerabilities-catalog

Vulnerability data from the NIST NVD. Exploitation data from the CISA KEV Catalog. Data on internet-exposed instances is sourced from Shodan (shodan.io). Exposure snapshot as of 2026-07-22. Exposed-instance counts are shown for context only and are NOT used as the funnel denominator. Fingerprint mapping is approximate and under-counts hosts behind load balancers or non-standard ports.

Snapshot 2026-07-22 · method v2.0-residual-gate2-bh