Track backlog burn-down: closure and intake rates, net change, current backlog and how long until you reach your target.
The number that matters is the net rate, not the closure count. A team closing 210 findings a month looks productive until you notice 165 arrived in the same month, leaving a net of 45 and a ten-month path to target. When the net rate is zero or negative, no amount of extra effort in the same mode will clear the backlog — the intake side has to change, usually through golden images, base-image patching or dependency upgrades. Backlog burn-down is the metric that shows whether your programme is actually improving or just running hard, and the days-to-target figure is what justifies automation spend.
Remediation Progress
Backlog now = starting backlog + new findings − closures. Net burn rate = (closures − new findings) ÷ period days, and days to target = (backlog − target) ÷ net burn rate.
Closure ratio
Closure ratio = closures ÷ intake. Below 100% the backlog grows no matter how many findings your team closes.
Backlog now = starting backlog + new findings − closures. Net burn rate = (closures − new findings) ÷ period days, and days to target = (backlog − target) ÷ net burn rate. The number that matters is the net rate, not the closure count. A team closing 210 findings a month looks productive until you notice 165 arrived in the same month, leaving a net of 45 and a ten-month path to target. When the net rate is zero or negative, no amount of extra effort in the same mode will clear the backlog — the intake side has to change, usually through golden images, base-image patching or dependency upgrades.
Backlog burn-down is the metric that shows whether your programme is actually improving or just running hard, and the days-to-target figure is what justifies automation spend.
This calculator takes 5 inputs: Backlog at the start of the period, Findings closed in the period, New findings in the period, Length of the period, Target backlog. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Because intake grew too, usually from new scan coverage, new assets or a noisy new plugin. Split intake into genuinely new exposure and newly visible existing exposure — the second kind is a one-off bulge and should be tracked separately.
No. A healthy programme runs a small steady-state backlog of low-severity findings; zero is achievable only by suppressing aggressively. Set the target from the volume you can hold within SLA, and keep criticals at zero instead.