05 - Vulnerability Metrics and KPIs
To ensure a vulnerability management program is effective, you must measure it. Executive leadership doesn't want to see a raw list of CVEs; they want to see trends, risk reduction, and operational efficiency.
Key Performance Indicators (KPIs)
1. Mean Time to Detect (MTTD)
The average time it takes for a vulnerability to be discovered in the environment after it is publicly disclosed.
- Goal: Minimize MTTD through continuous scanning and threat intelligence integration.
- Formula:
Sum of (Detection Date - Disclosure Date) / Total Vulnerabilities
2. Mean Time to Remediate (MTTR)
The average time it takes to patch or mitigate a vulnerability after it has been detected. This is the most critical metric for operational efficiency.
- Goal: Keep MTTR below your defined SLAs.
- Formula:
Sum of (Remediation Date - Detection Date) / Total Remediated Vulnerabilities
3. SLA Compliance Rate
The percentage of vulnerabilities that are remediated within the agreed-upon Service Level Agreement (SLA) timeframe.
- Example SLAs:
- Critical/KEV: 48 hours
- High: 14 days
- Medium: 30 days
- Formula:
(Vulnerabilities Patched Within SLA / Total Vulnerabilities Patched) * 100
4. Vulnerability Aging (Backlog)
A snapshot of unresolved vulnerabilities categorized by age (e.g., 0-30 days, 31-60 days, 90+ days).
- Goal: Prevent the buildup of "technical debt." A growing 90+ day backlog indicates operational failure.
5. Coverage Ratio
The percentage of total known assets that are actively scanned.
- Goal: 100%. If you have 10,000 servers but only scan 8,000, your metrics are blind to 20% of your risk.
Executive Reporting Dashboards
When presenting to leadership (CISO, Board of Directors), avoid technical jargon and focus on risk and compliance.
Key Dashboard Components:
- Risk Posture Trend: A line graph showing total open risk score over time. Is the organization getting safer or more vulnerable?
- SLA Adherence by Department: A bar chart comparing patching efficiency between different business units (e.g., IT Ops vs. DevOps). Use this to identify bottlenecks.
- Top 10 Most Critical Assets at Risk: Highlighting the most important servers or applications that currently have exploitable vulnerabilities.
- CISA KEV Exposure: A dedicated widget showing exactly how many known-exploited vulnerabilities exist in the environment right now. (This number should ideally always be 0).