5.1.3. Metrics, KPIs, and SLOs
💡 First Principle: What you measure shapes what you fix — vulnerability management metrics that focus only on total vulnerability count incentivize closing low-risk findings instead of the critical ones; metrics must align with actual risk reduction objectives.
Vulnerability Management Metrics and KPIs:
| Metric | What It Measures | Why It Matters |
|---|---|---|
| Top 10 vulnerabilities | Most prevalent/critical findings across the environment | Identifies systemic issues affecting many systems simultaneously |
| Critical vulnerabilities and zero-days | Count of unpatched critical findings; any zero-day exposure | Direct measure of immediate risk |
| Trends | Is the vulnerability backlog growing or shrinking? | Measures whether the program is making progress over time |
| SLOs (Service-Level Objectives) | % of vulnerabilities remediated within defined timeframes (Critical ≤ 7 days, High ≤ 30 days) | Operational compliance with remediation SLAs |
| Mean time to remediate (MTTRemediate) | Average time from vulnerability discovery to confirmed fix (for patchable findings it is often reported as mean time to patch, MTTP; break it out by severity) | Efficiency of the remediation process |
| Recurrence rate | % of vulnerabilities reappearing after remediation | Quality of remediation — patching that doesn't stick |
| False positive rate | % of scanner findings confirmed as false positives | Scanner tuning quality; analyst efficiency |
| Coverage | % of assets scanned in last 30/90 days | Completeness of visibility |
Using Metrics to Drive Improvement:
- SLO breach trending upward → remediation process has a bottleneck (investigate: staffing, approvals, testing, scheduling?)
- Recurrence rate increasing → patches are being applied but not persisting (investigate: configuration management, image updates, automated re-deployment of vulnerable configs)
- False positive rate high → scanner tuning needed (investigate: specific plugins generating noise, plugin configuration, network conditions affecting scans)
⚠️ Exam Trap: SLOs for patching are about remediation timelines, not scanning timelines. An organization can scan continuously but still miss SLOs if findings aren't remediated in time. The two metrics measure different things: scanning frequency measures detection capability; SLO compliance measures remediation effectiveness.
Trends, Top Risks, and SLA Compliance Together
An SLA compliance percentage (the share of findings remediated within the agreed timeframe) weights every finding equally. A report showing 94% within SLA can still include two internet-facing criticals that are months overdue. Report three things side by side:
- Trends — is exposure and SLA compliance improving or getting worse over time?
- Top risks — the specific highest-risk open items, with owners, age and what is blocking them. This is where leadership action is needed.
- SLA compliance — how reliably the process meets its timeframes, broken out by severity.
Never improve the percentage by dropping overdue items from the calculation. An exception needs a formal risk decision.
Leading and Lagging Indicators, and Building a Metrics Program
- Leading indicators predict future outcomes (unpatched critical vulnerabilities, scan coverage, training completion); lagging indicators measure past results (breaches, incidents). No single metric captures total risk: excellent patch-SLO compliance can coexist with breaches that arrive through zero-days, stolen credentials, misconfigurations or social engineering.
- Activity versus outcome: scans per month or percentage of assets in scope measure activity; a falling critical-vulnerability density (critical findings per 100 systems) measures risk reduction.
- Read metrics in context: a several-fold jump in total findings right after automated scanning starts usually means previously hidden risk became visible, not that the program degraded. High training completion beside a high simulated-phishing click rate shows the training is not changing behavior. Give leadership a reference point as well as a trend: a baseline, a target and a peer or industry benchmark.
- SLO and SLA: an SLO is an internal remediation target; an SLA is the formal commitment to another party. MTTD and MTTR measure speed of detection and response (see 5.2.2).
- Building a program: define program objectives first, then choose metrics that measure progress toward each objective, establish baselines, set targets and define the reporting cadence. Do not start by collecting everything and seeing what can be measured.
Reflection Question: A vulnerability management program reports 95% SLO compliance for Critical vulnerabilities (patched within 7 days). However, the same three systems appear in every quarterly report with unpatched High findings that are 6 months old. What does this metric pattern reveal about the program's effectiveness, and what governance change would address the root cause?
