A patch-lag leaderboard is less useful than it looks. The vendor that publishes a discovery date is double-reporting; the one that doesn't shows a misleading zero. The metric that matters is disclosure-to-patch for known-exploited bugs. https://vulntrends.org/blog/which-vendors-patch-the-fastest/ #patching #vulnerabilities #msrc #mttp #infosec