If you're getting scanned, keep logs, and have a decent way to tag log entries with the associated vuln, then you can start building statistical models of how exploit attempt probabilities fade as the target software gets older and lower market share. No, the 0.1% won't be exact. Yes, such data and models can be shared.
Paying $$$ for a LatestGreatest(tm) Firewall won't make you 100% secure either. And the $$$ might better be spent on an extra layer of swiss cheese, or better recovery capability.
Comments
How would you arrive at this percentage in your risk analysis?
If you're getting scanned, keep logs, and have a decent way to tag log entries with the associated vuln, then you can start building statistical models of how exploit attempt probabilities fade as the target software gets older and lower market share. No, the 0.1% won't be exact. Yes, such data and models can be shared.
Paying $$$ for a LatestGreatest(tm) Firewall won't make you 100% secure either. And the $$$ might better be spent on an extra layer of swiss cheese, or better recovery capability.