<h2>The Superior Security of One or the Other is a Cultural Bias, Not a Fact</h2>

Many security expert will back you in saying that Open Source is superior, but there have been shockingly few reliable studies to back this claim.  Most of the articles you find on this topic are opinion pieces that cite other opinion pieces (if they cite anything at all).  

When making arguments for Open Source, the most commonly cited metric is that mature, popular, open source projects like the Linux Kernel and mySQL have much lower defect densities than proprietary systems of similar complexities, but what studies I have seen on this topic use highly suspect methodologies by cherry picking from a very small number of open source projects that are already known to be well vetted, instead of using a random sampling of open source projects.  This sort of cherry picking is how you manipulate statistics to produce whatever outcome you desire.  This is equivalent to saying that Proprietary Software is more secure because Norton Antivirus is more resistant to hacking than a random sampling of open source projects. 

The only research I can find on the topic that is not using an obviously flawed methodology is a 2005 study [Software Vulnerabilities: Open Source versus
Proprietary Software Security][1].  This paper studied a random distribution of hundreds of open and closed source projects and found that there was no noticeable difference between how often Open Source and Proprietary software actually gets breached.  The one actual advantage you do see with open source, is that they typically release patches faster when a breach does happen... but that said, proprietary software is more likely to include functional auto updating features; so, while Proprietary often takes longer to release a patch, Open Source is more likely to not get patched after it is released.

<h2>How you should approach this problem</h2>

You can not use Open Source versus Proprietary as a reliable measure of security.  In reality, you can never prove that any given system is secure.  What you can do though is prove that a system is insecure, and that is done through penetration testing.  If it is your job to make sure that the system a business uses is secure, then the best job you can do is to prove that it is insecure. As long as it holds up to everything you can throw at it, you know that it is at least as good as any other option you can not beat.  Beyond that is just speculation.

  [1]: https://core.ac.uk/download/pdf/301342826.pdf