I disagree for exactly the reasons I've stated - "more vulns" doesn't take impact into account. "More vulns" doesn't take who is reporting them into account (in

I disagree for exactly the reasons I've stated - "more vulns" doesn't take impact into account. "More vulns" doesn't take who is reporting them into account (internal? paid pentester?). These things matter a lot. Again, look at projects that pay for vulns. They have hundreds a year - this is a good thing. They come in at a continuous rate. Counting is pointless.