Agree - to that extent, while I do care about raw number of vulnerabilities, I care more about the percentage of which were resolved, and how long it took for an issue to be patched.