Vulnerability management metrics: account for what happened to the same backlog

To explain whether a vulnerability backlog improved, follow the same set of findings from the start of a reporting period to its end. Count verified fixes, temporary protection, accepted exceptions, retired assets and unknown outcomes separately. Then report new findings alongside that fixed set.

This approach answers a question a changing total cannot: what happened to the work we already knew about? A smaller backlog may reflect completed fixes, but it can also reflect assets leaving scope or observations going stale. Leadership needs those explanations before deciding whether a remediation program is making progress.

What is a fixed cohort of findings?

A fixed cohort is a defined set of findings captured at a starting date. Its membership stays constant during the measurement period. Findings discovered later enter a separate arrival group, even if they affect the same application or share the same vulnerability identifier.

For this worksheet, count a finding as a vulnerability on a particular asset and, where necessary, a particular software instance. That is a recommended accounting unit, not a mandated industry definition. Record the identity rule so a scanner change or asset rename does not silently create a new unit.

The purpose is reproducibility. NIST SP 800-55 Volume 1 provides guidance on identifying and selecting information security measures. The cohort method below is an original practical application, not a NIST-prescribed formula or benchmark.

A broad discussion of remediation effectiveness metrics helps establish what a program values. Cohort accounting supplies the narrower explanation of where an opening backlog went.

Give each finding one reporting disposition

At the reporting cutoff, assign each opening finding one mutually exclusive disposition. Keep other attributes, such as severity and business importance, in separate columns. A finding can be both important and temporarily protected; those attributes should not cause it to be counted twice.

Define a precedence rule before reporting. In this example, a verified fix or confirmed retirement takes precedence. A still-vulnerable finding with evidenced temporary protection is classified as protected, even if an exception also exists. An accepted exception takes precedence over open. Insufficient evidence of the current state produces unknown.

Store the underlying facts as well as the chosen category. The single disposition makes the totals reconcile; it should not erase the exception approval or protection record that a reviewer may need.

Reconcile an opening cohort of 1,000 findings

The following dataset is hypothetical. It illustrates the arithmetic and is not an industry benchmark or a customer result.

The verified-fix share is 400 divided by 1,000, or 40%. Temporary protection accounts for another 15%, but combining the two into a 55% fix rate would mislabel the result. Retirement explains 10% of the opening population; it is a different outcome from repairing installed software.

The remaining categories expose decisions that need attention. Fifty accepted exceptions still require review under their agreed terms. Fifty unknown outcomes require evidence. Calling either group fixed would conceal work that has not been established as complete.

This is why the denominator stays fixed. If the 100 retired assets' findings were removed before the calculation, the same 400 fixes would appear as 44.4% of a 900-finding population. Both arithmetic operations are possible, but they answer different questions. The first describes the original cohort; the second describes a revised population.

Keep new arrivals outside the opening-cohort result

Suppose another 300 findings are discovered during the same period. Of those, 60 are verified fixed by the cutoff and 240 remain unresolved. Report those arrivals separately. Their existence should neither dilute nor improve the measured disposition of the original 1,000.

Across both groups, 460 findings were verified fixed. The opening cohort still has a 40% verified-fix share, while the new-arrival group has a 20% share. The groups had different time available for remediation, so the percentages are descriptive rather than a fair speed comparison.

If the team defines its unresolved workload as protected, accepted, open and unknown findings, the original cohort contributes 500 unresolved items. Add the 240 unresolved arrivals and the closing unresolved workload is 740. State that definition next to the number. Another organization may use a narrower operational queue, which should have a different label.

The resulting report can explain both throughput and workload: 460 verified fixes occurred, 100 findings left through confirmed retirement, and 740 findings remain unresolved under the stated definition. Every one of the 1,300 observed findings is accounted for.

How should reopened findings affect the numbers?

Use the finding's state at the reporting cutoff for the disposition table. If a finding was fixed and then reopened before that cutoff, place it in the applicable unresolved category. Keep the earlier fix and reopening in the event history so the work remains visible without being counted as a durable closing outcome.

A separate activity count can record remediation executions. Label it accordingly. Several executions against one finding do not create several fixed findings, and a successful intermediate event does not override a later observation of the vulnerable state.

For a reopening after the cutoff, preserve the original report and disclose the change in the next period. If late evidence proves the original report was wrong, issue a versioned correction with the reason. Quietly overwriting history makes comparisons difficult to audit.

Do not let lost visibility improve the result

When an asset disappears from a scan, the cohort still needs an outcome. Absence of a current observation is not sufficient retirement evidence. Keep the finding unknown until the team can establish whether the asset was decommissioned, missed, disconnected or otherwise outside the observation process.

Choose and document a freshness rule appropriate to the reporting purpose. There is no universal number of hours proposed here. A rule designed for a frequently connected server estate may not suit intermittent endpoints. Once selected, apply it consistently and disclose changes between periods.

Also preserve identity mappings when tools change. If an asset receives a new identifier, connect its old and new records before comparing the cohort. Treat deduplication corrections as corrections, with an audit trail, rather than presenting removed duplicates as remediation accomplishments.

Turn the reconciliation into a decision

Use the report to choose the next intervention. A large unknown category calls for restoring evidence. A growing protected category calls for reviewing the path to a permanent fix and the continuing validity of the controls. Repeated reopenings warrant investigation of the conditions that restore the vulnerable state.

Counts alone do not express business risk. Add a separate view of the same cohort by critical service or another documented priority dimension. Avoid implying that fixing many low-impact findings necessarily outweighs one unresolved finding on a critical service.

For the next reporting period, preserve the closed cohort and create a new opening snapshot. Keep a longer-lived cohort if leadership needs to follow an older backlog through several periods. Name each cohort and its dates so the reader can tell whether a chart tracks the same work or a succession of new populations.

Frequently asked questions

Which vulnerability management metrics show what happened to a backlog?

A fixed-cohort disposition table shows how the same opening findings ended the period. Pair it with new arrivals and reopened-finding events. This separates verified fixes from changes in population and observation.

Should temporary mitigation count as remediation?

Report temporary mitigation as its own outcome with evidence and review conditions. It may reduce exposure while the underlying issue remains. A verified-fix rate should contain only findings that meet the declared corrective-state criterion.

Is a falling vulnerability count proof of improvement?

A falling count needs an explanation. Verified fixes, retirement, deduplication and lost visibility can all change a total. Reconcile the same findings and show which changes account for the decline before interpreting it as improvement.

How does this differ from mean time to remediate?

Mean time to remediate measures elapsed time under a specified timing definition. Cohort accounting explains dispositions. Use them together: the time measure describes speed, while the reconciliation reveals unresolved, protected and unknown outcomes.

Apply the worksheet to your next report

Take one dated opening snapshot, assign a single evidenced disposition to every finding at the cutoff, and confirm the categories sum to the opening total. Add new arrivals separately. Bring the reconciliation to the next review and choose an action for the category that most needs attention.