Skip to content
ENExplore Calculators

Patch Compliance Calculator

Measure the share of findings remediated inside SLA overall and per severity, and how many more fixes you need to hit your target.

About Patch Compliance Calculator

Compliance counts against findings whose deadline fell in the period, not against everything open — otherwise a large backlog of not-yet-due work inflates the number. The weighted variant exists because unweighted compliance is dominated by mediums, and a programme can report 96% while missing a third of its critical deadlines. This is the figure auditors ask for and the one that appears in regulatory attestations, so it is worth defining precisely before someone else defines it for you.

Formulas

Patch Compliance

Compliance = findings closed within SLA ÷ findings due in the period; severity-weighted compliance = (5 × critical% + 3 × high% + 1 × medium%) ÷ 9.

closed within SLA
Verified remediated before the severity deadline
findings due
Findings whose SLA deadline fell in the period
5 / 3 / 1
Severity weights

Gap to target

Extra fixes needed = ceil(due × target ÷ 100) − on-time closures, the number of additional in-SLA remediations required to hit the target.

Worked example

With the default values below, Patch Compliance Calculator returns Overall Patch Compliance of 83.43%. Change any input above and every figure here is recalculated in your browser.

Inputs used

Critical findings dueaccepts 0–1,000,000 findings
24 findings
Critical closed within SLAaccepts 0–1,000,000 findings
19 findings
High findings dueaccepts 0–1,000,000 findings
86 findings
High closed within SLAaccepts 0–1,000,000 findings
68 findings
Medium findings dueaccepts 0–1,000,000 findings
240 findings
Medium closed within SLAaccepts 0–1,000,000 findings
205 findings
Compliance targetaccepts 0–100 %
95 %

Results

Overall Patch Compliance
83.43%
Severity-Weighted Compliance
79.83%
Critical Compliance
79.17%
High Compliance
79.07%
SLA Breaches
58 findings
Extra Fixes to Reach Target
41 findings
Status
Non-compliant — 41 more on-time fixes needed

Step by step

  1. 1Values used
  2. 2Patch Compliance
  3. 3Gap to target
  4. 4Overall Patch Compliance= 83.43
  5. 5Severity-Weighted Compliance= 79.83
  6. 6Critical Compliance= 79.17
  7. 7High Compliance= 79.07
  8. 8SLA Breaches= 58 findings
  9. 9Extra Fixes to Reach Target= 41 findings

Assumptions and limits

  • The result is derived only from the 7 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Patch Compliance calculated?

Compliance = findings closed within SLA ÷ findings due in the period; severity-weighted compliance = (5 × critical% + 3 × high% + 1 × medium%) ÷ 9. Compliance counts against findings whose deadline fell in the period, not against everything open — otherwise a large backlog of not-yet-due work inflates the number. The weighted variant exists because unweighted compliance is dominated by mediums, and a programme can report 96% while missing a third of its critical deadlines.

Why does Patch Compliance matter?

This is the figure auditors ask for and the one that appears in regulatory attestations, so it is worth defining precisely before someone else defines it for you.

What values do I need to enter?

This calculator takes 7 inputs: Critical findings due, Critical closed within SLA, High findings due, High closed within SLA, Medium findings due, Medium closed within SLA, Compliance target. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

What counts as remediated?

Verified by a rescan or an authenticated check, not marked done in a ticket. Self-attested closure is the single largest source of overstated compliance, and it fails the first time an auditor samples your evidence.

How should risk acceptances be treated?

Exclude them from the denominator only if they have a named owner, an expiry date and a compensating control on record; otherwise they are breaches with paperwork. Report the accepted count alongside compliance so the two cannot be confused.

Related Calculators

Patch Compliance Calculator | Calcrivo