When IBM filtered those unpatched security flaws by severity, however, Google came out as the least likely to patch critical security bugs in its software that would allow a hacker to completely hijack a target system, leaving 33% of those high severity flaws unpatched over the first half of the year.
It recommends that policymakers consider "steps that would increase the exposure of software and system vendors and system operators to liability for system breaches" as an incentive to face up to security issues instead of ducking their costs.