Remediation Performance
Closed months are frozen · current month shown separately as provisional · fictional sample
1 · Where we are now
Active Findings
—
vs last month end: —
Critical + High (VPR ≥ 7)
—
Critical — · High —
SLA Breach — Critical
—
VPR 9–10 · >14 days from SLA date
SLA Breach — High
—
VPR 7–8.9 · >30 days from SLA date
Resurfaced (active)
—
State REOPENED
Weaponized exploit
—
Exploit Maturity Functional / High
2 · Are we keeping up — last 6 closed months
Backlog at Month Start & End
Observed active findings on the 1st — frozen once the month closes
Latest Closed Month — Waterfall
—
3 · How fast — remediation responsiveness
Median Days to Fix
Tenable time_taken_to_fix · Critical/High vs Medium/Low
SLA Attainment — Critical/High
Fixed within 14 d (Critical) / 30 d (High) ÷ Critical/High fixed
Resolved before month median
Plugin median < month median · Critical/High
| Plugin | Plugin ID | Fixed | Hosts | Median |
|---|
Resolved after month median
Plugin median > month median · Critical/High
| Plugin | Plugin ID | Fixed | Hosts | Median |
|---|
4 · Current month — provisional
Month to date
Numbers change daily until the month closes. Backlog start is frozen.
Backlog start
—
—
New so far
—
Resurfaced so far
—
Fixed so far
—
Active now
—
Coverage so far
—
Median days to fix (C/H)
—
SLA attainment (C/H)
—
New so far — vulnerability list
First Seen this month · Risk Modified = NONE · VPR ≥ 0.1 · plugin IDs here are illustrative
| Hostname | IP | Plugin ID | Plugin Name | VPR | Tier | State | First Seen |
|---|
5 · Monthly Patch Performance — closed months only
Six closed months
Each row is locked when the month closes and never recomputes. End = observed active on the next 1st.
| Month | Start | New | Resurfaced | Fixed | End | Net | Resolved % | Backlog cleared % | Median days C/H | Median days M/L | SLA % | Method |
|---|
6 · Where the risk sits
Top Risky Assets (VPR)
Highest combined VPR exposure — active findings by VPR tier
| Rank | Hostname | IP | Critical | High | Medium | Low | Top VPR | Active |
|---|
Recast & Accept Risk (by Plugin)
Active findings with accepted or recasted risk — excluded from all counts above
| Plugin Name | Plugin ID | Type | Assets | Findings | Created | Expires |
|---|