OpenBSD has a reputation for being super secure but are there any big organizations that actually use it for security critical applications? A quick search shows outdated or non-related results.
The unique security features are nice but really there's a lot to say about how simple an OpenBSD system is to use and configure.
I knew it was deployed at a few non-tech oriented fortune 500 companies (eg not banks or tech firms) as last as 2016, but I've been out of that market since.
Connected to 123.4.002.312
Welcome to OpenBSD 6.2!
login:
When put to scrutiny OpenBSD fails the same way any other operating system does(https://isopenbsdsecu.re/about/)
Mind you, that was a great improvement over things like Windows NT, but "this is super secure as long as you don't do anything with it" is not as incredibly useful as it sounds like at first.
In the base install are many useful things (including a web server IIRC, though the port is not exposed by default), and those are audited and have that excellent track record.
Then when you install extra things, they are usually limited by what user they run as, and usually have pledge/unveil run (limiting access to predetermined/approved syscalls and parts of the file system) so they can't break other things if compromised.
Given the world runs on Linux servers, its pretty obvious that is probably the most secure.
Outside black boxes like M$ and Apple, FOSS OS level seems quite secure. How often do you see Linux malware caused by OS in the wild? Sure you install wordpress and never update it and get a cryptominer installed, but its not like anyone is pinging a server with a picture and an overflow error is causing a Pegasus exploit.
That's not obvious at all, and judging by CVE rates appears to be untrue.
They have done a lot of good, but they primarily equate security with code quality which is very short-sighted.
Here's a neat resource for OpenBSD's mitigations, some of which were/are novel, though it may not have been updated recently (2019):
To be considered a secure operating system, you need to have more mechanisms in place to protect against various threats, and the OBSD developers actively resist that. I'm familiar with their innovations and solutions, and I think they fall far short.