Summary

  • A LACNIC retrospective says a 2025 presentation by CEDIA’s Badí Quinteros described monthly public-surface monitoring of 47 Ecuadorian universities and a fall in the share receiving an F, or critical, rating from 23.4% to 11.1%.
  • The FIRST presentation abstract reports the same figures, but neither public account gives the number of institutions rated F or the number actually scored at each endpoint. The change is therefore not independently reproducible from the published material.

Analysis

A percentage without its count

LACNIC’s 29 September 2026 retrospective looks back to a 2025 session at LACNIC 44. It says Badí Quinteros of CEDIA presented monitoring data for 47 Ecuadorian universities and that the proportion with a critical rating fell from 23.4% to 11.1% as institutions addressed public vulnerabilities. The original FIRST symposium agenda gives the fuller presentation abstract: monitoring ran monthly from January to July 2025; it also reports unpatched critical and medium CVEs across the institutions, exposed credentials at more than 95%, an average portfolio score rising from 72 to 76, and Universidad Técnica del Norte moving from 42 to 97 points.

Those are reported findings, not a published dataset. The agenda and LACNIC summary are related accounts of the same presentation, not independent confirmation. Neither supplies a table of institution-level scores, the number rated F at the beginning and end, or the number included in each calculation. The grade scale, exact endpoint dates and treatment of missing scores are not specified in the material cited here.

That omission matters because “47 universities” describes the monitoring exercise, but does not by itself prove that all 47 were scored at both endpoints. If the denominator were 47 at both points, 23.4% would be consistent with 11 of 47 after rounding. But 11.1% is not the one-decimal share of any whole-number count out of 47. Five of 45, for example, rounds to 11.1%; that is only an arithmetic illustration, not evidence that 45 institutions were rated.

The gap does not show that either percentage is wrong. The later calculation could use a different number of scored institutions, a changing cohort, incomplete records, or a rating population that differs from the overall monitored set. The sources do not tell readers which explanation, if any, applies. Nor do the reported security scores establish that vulnerabilities, successful attacks or realized incidents declined. A score trend and an incident-rate trend are different measures.

The recent LACNIC post uses the result while inviting readers to a 2026 FIRST symposium. That context is useful for dating why the statistic has resurfaced, but it does not add another measurement or validate the earlier result. The FIRST agenda remains the original public description of the presentation; the later summary is a repetition, not a second dataset.

The narrow request is straightforward: publish the F-rated count and the number scored at each endpoint, identify the rating definition and dates, and say whether cohort coverage or missing-score treatment changed. No applicant-level or institution-level sensitive detail is needed to answer that aggregate question. Until then, the defensible statement is that the presentation reported a decline from 23.4% to 11.1%; the public record does not let a reader reconstruct its denominator.

Sources