I say it depends on from which perspective. If the number of changes going into one of the BDS OS is much less than the Linux's, it is possible there are fewer

I say it depends on from which perspective. If the number of changes going into one of the BDS OS is much less than the Linux's, it is possible there are fewer security vulnerabilities. But if you look at this from the other spectrum, it could mean fewer people are looking at it. Seriously, I don't think there is any fair comparison. Even if you compare the number of CVE, is there an absolute correlation between number of commits and number of security patches released? Perhaps, perhaps not. But many of the tools we are familiar with (e.g. OpenSSH itself being the classic one) did come from OpenBSD after forking from the original implementation, and perhaps is quite strong from the code quality. I never study the code, but from what I hear people generally praise the code quality as well as the attention to the overall architecture of OpenSSH. Someone from OS security should chime in. [1]: https://www.openssh.com/security.html https://www.openssh.com/security.html