Metrics That Matter
Twelve thousand vulns patched is a vanity number. Whether risk is falling and how fast is the real scoreboard.
What you will learn
- -Measure mean time to remediate split by severity tier
- -Report coverage honestly so blind spots do not fake your numbers
- -Track risk reduction over time instead of raw activity counts
A board slide that reads "12,000 vulnerabilities remediated this quarter" tells you nothing. Did the ones that mattered closed? Is lower than last quarter or higher? Activity metrics feel productive and measure almost nothing. The job is to pick the handful of numbers that track outcomes and ignore the ones that just track effort.
MTTR, split by severity
Mean time to remediate is how long a finding stays open from detection to verified close. Report it per severity tier, always, because a blended 40-day average hides the thing you need to know. You might be closing lows in a day and letting criticals rot for four months, and the single number would look fine. Track the median alongside the mean too, since one ancient finding drags the average up and around. The trend you want is critical MTTR falling toward your and staying pinned there.
Coverage, or every other number is fiction
Every metric here assumes you are scanning what you own. If you cover 60% of , your proud "95% SLA " is a statement about 60% of the company, and the unscanned 40% is exactly where you get breached. Report two coverage numbers so the gap cannot hide: percent of known assets scanned in the last N days, and percent scanned with . A low authenticated-coverage number is a quiet confession that your findings are the shallow banner kind from lesson 2.
Risk reduction, not raw counts
Total vulns found and total vulns patched are vanity metrics. They rise when you scan more and fall when you scan less, and neither one tracks whether the company is safer. Watch these instead.
- Open critical and KEV-listed count over time. This is the single line that should trend down, and the one leadership should actually see.
- SLA compliance: percent of findings closed inside their window, plus a hard count of what is past due right now.
- Recurrence rate: findings that come back because a got reimaged from an unpatched gold image. High recurrence means you are mopping the floor with the tap running.
Pay a team purely on closed-ticket count and they will close a thousand trivial lows and stall on the hard criticals, because that is what the scoreboard pays. Tie the incentive to critical MTTR and SLA compliance so the important, unglamorous work is the work that counts.
The tell of a program that is busy but not effective: 12,000 things patched, and the open-critical line flat or climbing. Motion is not progress. One time-series of open critical and KEV findings, with SLA breaches layered on top, tells the real story in a single glance, and it is the chart worth defending in a review.
Your dashboard shows one blended MTTR of 40 days across every severity. Name the single change that makes it useful for decisions.
A blended average hides whether criticals or lows are driving it. You need to see each tier on its own before the number means anything.