Vendor Pain Index — Q1 2026 vs Q2 2026

🦅 Vendor Pain Index — Q1 2026 vs Q2 2026

A quarter-over-quarter comparison of vendor security performance across three lenses: Revenue, R&D Spend, and Employees.

Each Pain Index is calculated as (CRITICAL × 3 + HIGH × 1) ÷ normalizer. A higher index means more security pain per unit — lower is better. Vendors with zero HIGH/CRITICAL CVEs in a given quarter are marked ✅.

📝 Editorial

Every quarter, vendors publish advisories, security bulletins and vulnerability disclosures. Security teams are expected to read them, understand them and somehow decide what deserves attention.

The problem is simple: there is too much information and too little time.

WSIC started as a personal project to deal with that reality.

After many years in infrastructure, networking and security, I found myself spending more time filtering information than acting on it. Hundreds of advisories, CVEs, vendor bulletins and release notes compete for attention every week. Most are worth knowing. Some are worth acting on. A few will ruin your weekend.

WSIC was created to help tell the difference. The daily briefings focus on a single question: Why Should I Care?

The Vendor Pain Index applies the same thinking to vendors.

Rather than counting vulnerabilities in isolation, the goal is to explore a broader question: which vendors generate disproportionately high amounts of operational security work relative to their size and resources?

The answer is not always obvious. A vendor may report hundreds of vulnerabilities and still perform reasonably well once revenue, R&D spending or workforce size are taken into account. Others may report relatively few vulnerabilities but rank poorly after normalization.

This report is therefore not a measure of vendor quality.
It is not a buyer's guide.
It is not investment advice.
It is not an attempt to name and shame.
It is simply an experiment in looking at security data from a different angle.

A known limitation worth naming

The formula counts CVEs at the point of public disclosure — not at the point of patching. This creates a subtle distortion. A vendor that practises responsible coordinated disclosure — fixing a vulnerability privately first, then disclosing after customers have had time to patch — may appear to release many CVEs in a single quarter. That is not the same as a vendor that leaves known vulnerabilities unpatched for months before acting.

We are aware of this. Monitoring trends over multiple quarters will help distinguish between disclosure patterns and genuine security posture. A single bad quarter can have many explanations. A consistently high Pain Index across quarters is harder to explain away.

A note on humility

We did not arrive at this methodology with all the answers. The formulas are a starting point, not a conclusion. Some readers will disagree with the weighting. Others will suggest better normalizers. That is exactly the kind of conversation we want to start.

The methodology will evolve. We will get things wrong. We will correct them.

If this report starts discussions about how we measure software quality, engineering effectiveness and security outcomes, then it has already achieved its goal.

After all, the purpose of WSIC is not to provide answers. The purpose is to help ask better questions.

🦅 Built by an engineer who got tired of reading 200 security alerts a day and discovering breaking changes hidden in release notes.

🦅 Key Findings

• The biggest mover in Q2 was Progress Software, which jumped from a pain score of 1.0000 in Q1 to 21.0000, a staggering increase of +20.0000. This dramatic shift in the Vendor Pain Index (VPI) highlights the company's rapid growth and potential challenges in maintaining quality under increased pressure.
• Microsoft and Google stood out as raw volume outliers in Q2, with Microsoft reporting 40 CRIT and 100 HIGH CVEs, while Google had 26 CRIT and 37 HIGH vulnerabilities. These numbers underscore the ongoing struggle to secure complex software ecosystems.
• GitLab demonstrated cross-metric consistency by improving its pain scores across all three metrics (revenue, R&D spend, and employees) in Q2, with reductions of +5.0000, -18.5185, and -1.9231, respectively. This improvement suggests the company is making strides to address its weaknesses.
• Progress Software's deteriorated pain scores across all three metrics (revenue, R&D spend, and employees) in Q2 are concerning, with increases of +20.0000, +105.2631, and +7.1429, respectively. This trend may indicate a need for closer monitoring to prevent a decline in overall security posture.
• The Vendor Pain Index's findings highlight the importance of considering multiple metrics when evaluating vendor performance. By examining revenue, R&D spend, and employee pain scores together, IT decision-makers can gain a more comprehensive understanding of a vendor's strengths and weaknesses.

📊 Quarterly Analysis

Overall, Q2 saw a mixed bag of performance from the vendors in our latest Vendor Pain Index report. GitLab, once again, emerged as the leader across all three metrics, but Progress Software's woes only intensified. The most improved vendor, GitLab, showed significant improvement in both revenue and R&D spend, while Progress Software's decline was stark – a trend we hope they will address soon.

In terms of Revenue, GitLab has solidified its position as the leader, with a pain score of 5.0000 in Q2, down from 10.0000 in Q1. This significant improvement suggests that GitLab is making efforts to streamline their operations and reduce the risk of security breaches. Progress Software, on the other hand, saw its revenue-related pain increase by 16 times, indicating a major issue with their financial management and potentially exposing them to increased cybersecurity risks.

The R&D spend metric also showed GitLab's improvement, with a score of 18.5185 in Q2, down from 37.0370 in Q1. This reduction suggests that GitLab is investing more effectively in security research and development, allowing them to stay ahead of emerging threats. In contrast, Progress Software's R&D spend-related pain increased by over 100 times, indicating a lack of investment in cybersecurity capabilities.

Employees was the metric where GitLab continued its dominance, with a score of 1.9231 in Q2, down from 3.8462 in Q1. This improvement suggests that GitLab has made strides in hiring and training security talent, allowing them to better protect their customers' data. Progress Software's employees-related pain increased by over 20 times, indicating significant issues with employee vetting, onboarding, or training – all critical components of a robust cybersecurity program.

As IT decision-makers review the Vendor Pain Index report, two key takeaways stand out: invest in vendors that demonstrate a commitment to security, and address vulnerabilities quickly. GitLab's continued leadership suggests they are doing something right, but Progress Software's decline is a stark warning – don't wait until it's too late.

📊 Pain by Revenue

🔄 New Leader: Progress Software — takes the top spot in Q2 2026 with a Pain Index of 21.0000, displacing GitLab (10.0000 in Q1 2026).

🟢 Most Improved: GitLab — Pain Index dropped from 10.0000 (Q1 2026) to 5.0000 (Q2 2026) — a change of -5.0000.

🔴 Most Deteriorated: Progress Software — Pain Index rose from 1.0000 (Q1 2026) to 21.0000 (Q2 2026) — a change of +20.0000.

🟠 Q2 2026 (current quarter)

📍 Q1 2026 (previous quarter, for reference)

📊 Pain by R&D Spend

🔄 New Leader: Progress Software — takes the top spot in Q2 2026 with a Pain Index of 110.5263, displacing GitLab (37.0370 in Q1 2026).

🟢 Most Improved: GitLab — Pain Index dropped from 37.0370 (Q1 2026) to 18.5185 (Q2 2026) — a change of -18.5185.

🔴 Most Deteriorated: Progress Software — Pain Index rose from 5.2632 (Q1 2026) to 110.5263 (Q2 2026) — a change of +105.2631.

🟠 Q2 2026 (current quarter)

📍 Q1 2026 (previous quarter, for reference)

📊 Pain by Employees

🔄 New Leader: Progress Software — takes the top spot in Q2 2026 with a Pain Index of 7.5000, displacing GitLab (3.8462 in Q1 2026).

🟢 Most Improved: GitLab — Pain Index dropped from 3.8462 (Q1 2026) to 1.9231 (Q2 2026) — a change of -1.9231.

🔴 Most Deteriorated: Progress Software — Pain Index rose from 0.3571 (Q1 2026) to 7.5000 (Q2 2026) — a change of +7.1429.

🟠 Q2 2026 (current quarter)

📍 Q1 2026 (previous quarter, for reference)

🦅 Vendor Pain Index by Donna AI  |  Data: NVD · CISA KEV · Yahoo Finance
Pain Index = (CRITICAL × 3 + HIGH × 1) ÷ normalizer. CRITICAL = CVSSv3 ≥ 9.0 · HIGH = CVSSv3 7.0–8.9

📋 Complete Monitoring Scope — Q2 2026

The following vendors and projects are tracked every quarter. Inclusion in the ranked tables requires a public stock listing with available financial data. Everything else is listed here for transparency.

✅ Zero HIGH/CRITICAL CVEs this quarter — Public vendors

These vendors had no HIGH or CRITICAL CVEs published in NVD during this quarter. A clean quarter does not guarantee a clean posture — but it is worth acknowledging.

Atlassian · Check Point · CrowdStrike · Okta · Qualys · SAP · Salesforce · SentinelOne · ServiceNow · Zscaler

⚠️ Private vendors — monitored, no financial data

These vendors are tracked but cannot be included in normalized rankings because financial data is not publicly available. CVE counts are monitored.

Cloud Software Grp · ConnectWise · Ivanti · SolarWinds · WatchGuard

🔓 Open source projects — monitored, no financial data

Open source projects are widely deployed in enterprise infrastructure. They are tracked because their vulnerabilities matter — but without revenue, R&D spend or headcount to normalize against, they cannot be ranked alongside commercial vendors. A separate analysis may be warranted in a future edition.

💡 A note on open source and enterprise responsibility.
These CVEs represent real work: real researchers finding real bugs, real developers fixing them, often without pay. If your organization runs on open source and has never contributed back, this is a good moment to reconsider. Better-funded open source is more secure open source. Consider donating or sponsoring the projects your infrastructure depends on.

⚠️ Private & Commercial Vendors — Q1 2026 vs Q2 2026

No public financial data — Pain Index cannot be calculated. Absolute CVE counts only. Score = CRITICAL × 3 + HIGH.

🔓 Open Source Projects — Q1 2026 vs Q2 2026

No financial normalization possible. Score = CRITICAL × 3 + HIGH.

📚 Sources & Methodology

• CVE Data: NIST NVD API v2.0 — official U.S. government repository. Every CVE is counted once. Severity based on CVSSv3 base score (HIGH: 7.0–8.9 · CRITICAL: ≥9.0).
• Actively Exploited (🔥): CISA KEV Catalog — confirmed active exploitation in the wild.
• Company Metrics: Yahoo Finance via yfinance — point-in-time snapshot. Revenue and R&D are TTM from the most recent annual filing. Employee count as reported in the latest annual filing.
• Pain Index Formula: (CRITICAL × 3 + HIGH × 1) ÷ Normalizer. CRITICAL weighted 3× to reflect higher exploitability and impact.
• Three Lenses: Revenue, R&D Spend, Employees — each normalizer tells a different story. Vendors that rank poorly across all three have a harder case to make.
• Private vendors (no stock ticker) are excluded from ranked tables — financial data not publicly available. Listed separately for completeness.