Your models are missing half the data.

You price risk from databases that are systematically incomplete.

Public CVE databases, audit reports, and disclosed incident histories account for less than half of actual security fixes. According to Chainguard’s 2024 analysis, more than 50% of open-source security fixes are never disclosed publicly. No CVE. No advisory. No changelog entry. The fix ships as a routine update and the vulnerability record never enters your data.

This means every premium priced, every risk assessed, every coverage decision made, every investment thesis validated, and every audit delivered is built on an incomplete foundation.

The problem is structural, not accidental. Protocols have a direct financial incentive to hide vulnerabilities. A known CVE causes risk assessors to reprice. Silence keeps costs low. The entire market subsidizes the silence.

Same bug, four exploits, thirteen months, $31.6 million.

Compound V2’s exchange rate manipulation bug was exploited across four different protocol forks over a thirteen-month window. Total losses: $31.6 million. The vulnerability was known after the first exploit. Three more protocols were hit because no CVE was filed and no downstream notification was issued.

One piece of upstream intelligence would have prevented three of those incidents. Whether you are the underwriter paying claims, the auditor who cleared the protocol, the investor holding the token, or the maintainer running the fork — the missing data cost you.