How many CVEs are in the software you're not updating in a timely manner if at all?

You got it wrong. In AI era, the trade-off is between CVE and vulnerabilities that people haven't noticed yet. In the AI era, the forest is ALWAYS on fire. Even when you don't see the smoke.