http://gpl3.blogspot.com/2009/01/2008-risk-report.html
The research group has developed tools that objectively track and report on operational risk associated with software applications, operating systems and hardware.
Two reports are included on the site, top 10 and top 25 risky software.