Patch SLA Compliance Calculator

Work out patch sla compliance instantly with clear inputs, formula shown and shareable results.

About Patch SLA Compliance Calculator

Patch SLA compliance is the share of in-scope findings remediated inside the agreed window, and it is the metric auditors and regulators most often ask for. The useful companion figure is how many additional on-time remediations would close the gap to target, because that converts a percentage into a work item count the team can plan against.

Formula

SLA compliance

compliance = patched within SLA / total in scope; extra needed = ceil(total x target) - patched on time

Worked example

With the default values below, Patch SLA Compliance Calculator returns SLA compliance of 77.50%. Change any input above and every figure here is recalculated in your browser.

Inputs used

Vulnerabilities in scopeminimum 1: 1,400
Patched within SLAminimum 0: 1,085
SLA targetminimum 1 days: 30 days
Compliance targetaccepts 1–100 %: 95 %

Results

SLA compliance: 77.50%
Vulnerabilities patched late: 315
Gap to target: 17.50%
Extra on-time patches needed to hit the target: 245

Step by step

1Values used
2SLA compliance
3SLA compliance= 77.50
4Vulnerabilities patched late= 315
5Gap to target= 17.50
6Extra on-time patches needed to hit the target= 245

Assumptions and limits

The result is derived only from the 4 inputs listed above. Anything not among them is not part of the calculation.
In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

Should risk-accepted findings count as breaches?

Only if the acceptance was not formally approved. Documented, time-bound exceptions are normally excluded from the denominator, but undocumented ones are breaches.

Why differentiate SLA by severity?

Because remediation effort is finite. Typical tiers are 7 days for critical, 30 for high and 90 for medium, which concentrates urgency where exploitation is most likely.