IBM: Public vulnerabilities are tip of the iceberg

But security experts point out that nondisclosure of flaws doesn't necessarily increase security risk.