Is there any evidence or research into the likelihood, as well as damage, via vulnerabilities in previous versions compared to following iterations of software?
For example, with every software version, there is the likelihood of new security vulnerabilities. More importantly, the existence and likelihood of those vulnerabilities will be unknown. Whereas by staying on the previous version, even if you're now vulnerable to a possibly existing risk, it may be a vulnerability that is documented. Of course, that may not always be the case but if it is an unknown vulnerability in version 1, then it will be an unknown vulnerability in version 1+. If that vulnerability is mitigated in version 1+, then we're back to the point of this question:
- Version 1: unknown and known vulnerabilities, versus
- Version 1+: unknown and possible introduction of different vulnerabilities
This is not a duplicate of other questions with similar titles because I'm looking for facts, whereas a lot of other posts include much conjecture.