Why Vulnerability Reduction Percentages Can Be Misleading

You see this kind of number in security writing all the time. “We reduced vulnerabilities by 80%.” “Critical findings dropped 90%.” “Open Highs reduced by 75% over six months.” The numbers travel through case studies, vendor pitches…