This would be my first answer also. It’s traditionally been considered to be a highly (or the most) secure OS because of their focus on security. That means if

This would be my first answer also. It’s traditionally been considered to be a highly (or the most) secure OS because of their focus on security. That means if you stay within their ecosystem you are unlikely to ever have to worry about zero days. But it depends on what you want to do and what your threat model looks like. As others has written, knowing your system is probably more important as I believe (mis)configuration is one of the more common ways to get hacked. And even the most secure OS won’t help you if you accidentally expose your elastic cluster to the internet. To wrap, I’d say the best thing you can do to secure yourself is “defence in depth”. Use a locked down OS. Add a firewall (or two if one is a soft one which can be bypassed or disabled accidentally). Don’t bind services to internet interfaces unless you want it. Ensure you have authentication enables. Enable auto-updates for anything exposed. If you do this you don’t have to worry about picking the most secure OS.