5.1.3. Metrics, KPIs, and SLOs
💡 First Principle: What you measure shapes what you fix — vulnerability management metrics that focus only on total vulnerability count incentivize closing low-risk findings instead of the critical ones; metrics must align with actual risk reduction objectives.
Vulnerability Management Metrics and KPIs:
| Metric | What It Measures | Why It Matters |
|---|---|---|
| Top 10 vulnerabilities | Most prevalent/critical findings across the environment | Identifies systemic issues affecting many systems simultaneously |
| Critical vulnerabilities and zero-days | Count of unpatched critical findings; any zero-day exposure | Direct measure of immediate risk |
| Trends | Is the vulnerability backlog growing or shrinking? | Measures whether the program is making progress over time |
| SLOs (Service-Level Objectives) | % of vulnerabilities remediated within defined timeframes (Critical ≤ 7 days, High ≤ 30 days) | Operational compliance with remediation SLAs |
| Mean time to remediate (MTTRemediate) | Average time from vulnerability discovery to confirmed fix | Efficiency of the remediation process |
| Recurrence rate | % of vulnerabilities reappearing after remediation | Quality of remediation — patching that doesn't stick |
| False positive rate | % of scanner findings confirmed as false positives | Scanner tuning quality; analyst efficiency |
| Coverage | % of assets scanned in last 30/90 days | Completeness of visibility |
Using Metrics to Drive Improvement:
- SLO breach trending upward → remediation process has a bottleneck (investigate: staffing, approvals, testing, scheduling?)
- Recurrence rate increasing → patches are being applied but not persisting (investigate: configuration management, image updates, automated re-deployment of vulnerable configs)
- False positive rate high → scanner tuning needed (investigate: specific plugins generating noise, plugin configuration, network conditions affecting scans)
⚠️ Exam Trap: SLOs for patching are about remediation timelines, not scanning timelines. An organization can scan continuously but still miss SLOs if findings aren't remediated in time. The two metrics measure different things: scanning frequency measures detection capability; SLO compliance measures remediation effectiveness.
Reflection Question: A vulnerability management program reports 95% SLO compliance for Critical vulnerabilities (patched within 7 days). However, the same three systems appear in every quarterly report with unpatched High findings that are 6 months old. What does this metric pattern reveal about the program's effectiveness, and what governance change would address the root cause?
