Remediation Progress Calculator

Backlog now = starting backlog + new findings − closures. Net burn rate = (closures − new findings) ÷ period days, and days to target = (backlog − target) ÷ net burn rate. The number that matters is the net rate, not the closure count. A team closing 210 findings a month looks productive until you notice 165 arrived in the same month, leaving a net of 45 and a ten-month path to target. When the net rate is zero or negative, no amount of extra effort in the same mode will clear the backlog — the intake side has to change, usually through golden images, base-image patching or dependency upgrades.

Backlog burn-down is the metric that shows whether your programme is actually improving or just running hard, and the days-to-target figure is what justifies automation spend.

This calculator takes 5 inputs: Backlog at the start of the period, Findings closed in the period, New findings in the period, Length of the period, Target backlog. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Because intake grew too, usually from new scan coverage, new assets or a noisy new plugin. Split intake into genuinely new exposure and newly visible existing exposure — the second kind is a one-off bulge and should be tracked separately.

No. A healthy programme runs a small steady-state backlog of low-severity findings; zero is achievable only by suppressing aggressively. Set the target from the volume you can hold within SLA, and keep criticals at zero instead.