The Part You Can See
We scored 25 web frameworks and found that 43% of the web runs on WordPress — a platform with 18,005 known vulnerabilities. That made headlines. But web frameworks are the visible part of the iceberg.
Below the waterline sits the infrastructure that actually runs businesses: custom enterprise applications, internal tools, API backends, data pipelines, workflow systems, and integrations built over decades. Nobody scores these. Nobody tracks their CVEs in aggregate. Nobody calculates their total cost of ownership. That's why the problem persists.
The Scale of Legacy
The Pattern Is Always the Same
It doesn't matter if it's WordPress, a custom Java app, a Python 2 data pipeline, or a COBOL batch process. The pattern is identical:
Year 1: It works. Year 3: The original developer left. Year 5: Nobody fully understands it. Year 7: It's too risky to change and too expensive to replace. Year 10: It runs the business and terrifies everyone who knows what's inside.
We see this pattern in web frameworks because the data is public. But every CTO reading this recognizes it in their own systems.
Why Nobody Talks About It
Web framework data is public — CVEs are in the NVD, GitHub repos are open, market share is crawlable. Enterprise application health is private. No CTO publishes their technical debt. No CISO discloses their legacy exposure voluntarily.
The result: everyone assumes they're the only ones with this problem. They're not. The problem is structural, not individual. And it's getting worse at a rate that mirrors the WordPress CVE curve — quietly compounding until something breaks publicly.
What We're Building Toward
WebPulse started with web frameworks because the data was accessible and the results undeniable. But the scoring methodology — Security, AI-Readiness, Ecosystem Health, Cost of Ownership, Talent Availability — applies to any technology stack.
The question isn't 'should you move off WordPress.' The question is: 'what is the true health score of every piece of technology your business depends on?' Web frameworks are chapter one. The full infrastructure audit is the book.
