Some of the good things about open source software are also bad things, from a risk perspective.
For example, hardware firewalls tend to run on very closed and proprietary OS kernels.
In terms of finding and exploiting vulnerabilities, having knowledge of the source of the OS can be a bad thing.
The Open Source argument to that is, of course, that the more knowledge of the system and/or it's vulnerabilities, the greater number of great minds will develop a better solution.
But the real issue is software quality, no?
The question is how to achieve software quality: through cooperative knowledge sharing or through the vendor-based profit-driven model?
I think we need both.
Open Source has been a way to encourage innovation and bring solutions to users faster and cheaper, which are good things.
The obvious problem with Open Source is that programmers have to eat. The business model for open source is mainly that the support and service revenue stream is enough to make open source companies profitable.
The irony, of course, is the better the software, the less support it needs, thus putting a big hole in an already leaky business model. Yes, RadHat is doing well, so there is hope...