Scan Coverage Percentage Calculator

Work out scan coverage percentage instantly with clear inputs, formula shown and shareable results.

About Scan Coverage Percentage Calculator

Coverage has two dimensions that are frequently conflated. Breadth is the share of the inventory reached at all, and unscanned assets are pure blind spots. Depth is the share scanned with credentials, since unauthenticated scans miss most client-side and configuration issues. Frequency sets the blind window: with weekly scans, a new vulnerability goes unnoticed for an average of three and a half days.

Formula

Coverage metrics

coverage = scanned / inventory; authenticated coverage = credentialed scans / inventory; average blind window = scan interval / 2

Worked example

With the default values below, Scan Coverage Percentage Calculator returns Scan coverage of 80.00%. Change any input above and every figure here is recalculated in your browser.

Inputs used

Assets in the inventoryminimum 1: 5,400
Assets successfully scannedminimum 0: 4,320
Assets scanned with credentialsminimum 0: 2,900
Scan intervalminimum 1 days: 7 days

Results

Scan coverage: 80.00%
Authenticated scan coverage: 53.70%
Assets never scanned: 1,080
Average time a new vulnerability goes unseen: 3.5 days

Step by step

1Values used
2Coverage metrics
3Scan coverage= 80.00
4Authenticated scan coverage= 53.70
5Assets never scanned= 1,080
6Average time a new vulnerability goes unseen= 3.5 days

Assumptions and limits

The result is derived only from the 4 inputs listed above. Anything not among them is not part of the calculation.
In particular, this calculator does not take inflation, tax or fees or charges into account.
Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

Why does authenticated scanning matter so much?

Unauthenticated scans see only what the network exposes. Missing patches, weak local configuration and installed-software inventory require credentials, and coverage without them overstates assurance.

Is the inventory itself reliable?

That is the harder problem. Coverage measured against an incomplete inventory looks excellent while whole environments go unseen, so reconcile against cloud APIs and network discovery.