I'm afraid it'd be useless to go into technical details about nr of CVE's and amount of packages and all that. Acting from a position of defense doesn't work in publicity. I guess it'd be better to work on getting it more widely known that e.g. NASA chooses Debian. My 0,02. Bye, Joost