Not the one you asked, but here’s my two cents. Arch, by virtue of its DIY nature, has little to no defaults. As such, common security measures are not pre-configured either. Thankfully, it makes up for that with its excellent wiki entry on security. Unfortunately, I don’t think most users ever seriously implement what’s found within. As for Debian, it actually does come with plenty of relatively sane defaults, including security. And Debian has shown to take security rather seriously. However, (most) Debian repositories are not great at providing up-to-date versions of the software they package: The stable branch has outdated packages for the sake of providing a ‘boring’ (but reliable) experience. While security updates are backported, it is not the preferred way of keeping software safe and secure. The testing branch is in a disturbing condition in which it holds software that is a bit more stable than the unstable branch. However, it does not enjoy the security updates backported to the stable branch. Nor does it immediately receive the security updates as they come to the unstable branch. A rather unsettling middle ground, if you will. Definitely not recommended for the security-conscious. Finally, the unstable branch. Intuitively, this should provide the fix for the above problems. It should provide current software, which should mean that it receives updates as they’re released, security included. But, anecdotally, the likes of Arch, Fedora and openSUSE seem to be doing a better job at offering a (semi-)rolling release distro. But, please be my guest, and prove them wrong.