Practically speaking, it's impossible to compare these metrics between open and closed systems for various reasons. In open systems, bug reporting is a part of

Practically speaking, it's impossible to compare these metrics between open and closed systems for various reasons. In open systems, bug reporting is a part of the culture. Moreover, as you are closer to the vendor, you can actually count on it being fixed, in trivial cases overnight. You have public bug tracking systems where the bug is almost like your baby: you talk to others about it, you argue in favor if it being fixed. Moreover, a good number of users actually fixes the bugs. Sometimes it's enough a bug report is published that you patch your own system without asking anyone. As source code is available, for some people it's a kind of a hobby to go through and find bugs. Some do it for sport, some for learning/as a part of their curriculum, some as a part of their product development or audits. With closed systems, many of these points above are not true. Users are not accustomed to reporting bugs, and even if they report a bug sometimes, they become put off as they don't know what happens with it later. They don't actively analyze the source code to find bugs. If a bug is found, they pray the patch is released soon. It is very rare someone has enough low-level skills to manually patch a binary based on a CVE description. Given these differences, I think the only viable metric is the response time, i.e. the time between the bug being disclosed and fixed.