Closing a thousand vulnerabilities in three months sounds like a win. It isn't. And the fact that it sounds like one is exactly the problem.