SBOM/Vulnerability Scanner Calculator

Prioritise vulnerability remediation effort across severity levels.

About SBOM/Vulnerability Scanner Calculator

Weighting by severity prevents a long tail of low findings from masking a single critical issue. Separating priority hours from total hours is what makes the remediation plan schedulable. Most reported vulnerabilities are not reachable from the application's code paths, so triage by exploitability matters as much as severity when allocating the hours.

Formula

SBOM/Vulnerability Scanner

Risk score = 40 × critical + 10 × high + 3 × medium + 1 × low

SBOM: Software bill of materials, the dependency inventory scanners work from
weighted score: Reflects that one critical outweighs many low findings

Worked example

With the default values below, SBOM/Vulnerability Scanner Calculator returns Weighted Risk Score of 490.0. Change any input above and every figure here is recalculated in your browser.

Inputs used

Critical vulnerabilitiesminimum 0: 3
High vulnerabilitiesminimum 0: 14
Medium vulnerabilitiesminimum 0: 46
Low vulnerabilitiesminimum 0: 92
Average hours per remediationminimum 0 h: 1.5 h

Results

Weighted Risk Score: 490.0
Total Vulnerabilities: 155
Hours to Fix Critical and High: 25.50 h
Hours to Fix Everything: 232.50 h
Risk Band: Critical — patch immediately

Step by step

1Values used
2SBOM/Vulnerability Scanner
3Weighted Risk Score= 490.0
4Total Vulnerabilities= 155
5Hours to Fix Critical and High= 25.50 h
6Hours to Fix Everything= 232.50 h
7Risk Band= Critical — patch immediately

Assumptions and limits

The result is derived only from the 5 inputs listed above. Anything not among them is not part of the calculation.
In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is SBOM/Vulnerability Scanner calculated?

Risk score = 40 × critical + 10 × high + 3 × medium + 1 × low Weighting by severity prevents a long tail of low findings from masking a single critical issue. Separating priority hours from total hours is what makes the remediation plan schedulable.

Why does SBOM/Vulnerability Scanner matter?

Most reported vulnerabilities are not reachable from the application's code paths, so triage by exploitability matters as much as severity when allocating the hours.

What values do I need to enter?

This calculator takes 5 inputs: Critical vulnerabilities, High vulnerabilities, Medium vulnerabilities, Low vulnerabilities, Average hours per remediation. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.