Skip to content
ENExplore Calculators

Security Debt Calculator

Quantify unremediated vulnerability debt in weighted units, engineer hours and money, including the interest it accrues each month.

About Security Debt Calculator

The age factor is what makes this debt rather than a backlog count: an eighteen-month-old critical is worth two and a half of the same finding raised yesterday, because the exposure has been continuous and the fix has usually got harder as the system drifted. Monthly interest is the debt the backlog adds just by existing, which is the number to compare against your closure rate. Framing unpatched vulnerabilities as debt with interest gets engineering leadership to fund reduction campaigns, where a list of 272 open findings gets filed and forgotten.

Formulas

Security Debt

Debt = Σ over severities of count × severity weight (10 critical, 5 high, 1 medium) × (1 + average age in days ÷ 365), so a year-old finding counts double.

severity weight
10 critical, 5 high, 1 medium
age factor
1 + age ÷ 365, doubling at one year
principal
Debt with the age factor removed
interest
Principal × 30 ÷ 365 — one month of ageing

Effort and cost

Remediation effort = 6 hours per critical + 3 per high + 1.5 per medium, and cost multiplies those hours by the blended engineering rate.

Worked example

With the default values below, Security Debt Calculator returns Security Debt of 994.9. Change any input above and every figure here is recalculated in your browser.

Inputs used

Open criticalsaccepts 0–1,000,000 findings
18 findings
Average age of open criticalsaccepts 0–3,650 days
95 days
Open highsaccepts 0–1,000,000 findings
64 findings
Average age of open highsaccepts 0–3,650 days
140 days
Open mediumsaccepts 0–1,000,000 findings
190 findings
Average age of open mediumsaccepts 0–3,650 days
260 days
Blended engineering costaccepts 0–2,000 currency/hour
85 currency/hour

Results

Security Debt
994.9 debt units
Engineer Hours to Clear
585.0 hours
Cost to Clear
$49,725.00
Interest Accrued per Month
56.7 debt units
Debt Level
High — needs a dedicated reduction campaign
Where the Debt Sits
Highs — 443 of the units carry the debt

Step by step

  1. 1Values used
  2. 2Security Debt
  3. 3Effort and cost
  4. 4Security Debt= 994.9 debt units
  5. 5Engineer Hours to Clear= 585.0 hours
  6. 6Cost to Clear= 49,725.00
  7. 7Interest Accrued per Month= 56.7 debt units
  8. 8Debt Level= High — needs a dedicated reduction campaign
  9. 9Where the Debt Sits= Highs — 443 of the units carry the debt

Assumptions and limits

  • The result is derived only from the 7 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax or compounding frequency into account.
  • Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Security Debt calculated?

Debt = Σ over severities of count × severity weight (10 critical, 5 high, 1 medium) × (1 + average age in days ÷ 365), so a year-old finding counts double. The age factor is what makes this debt rather than a backlog count: an eighteen-month-old critical is worth two and a half of the same finding raised yesterday, because the exposure has been continuous and the fix has usually got harder as the system drifted. Monthly interest is the debt the backlog adds just by existing, which is the number to compare against your closure rate.

Why does Security Debt matter?

Framing unpatched vulnerabilities as debt with interest gets engineering leadership to fund reduction campaigns, where a list of 272 open findings gets filed and forgotten.

What values do I need to enter?

This calculator takes 7 inputs: Open criticals, Average age of open criticals, Open highs, Average age of open highs, Open mediums, Average age of open mediums, Blended engineering cost. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Are the effort hours realistic?

They are averages for patch-and-verify work on managed systems. Findings needing a code change, a vendor upgrade or a migration cost far more, so track those separately — a handful of them can outweigh the entire routine backlog.

Should risk acceptances count as debt?

Yes, at full weight. An accepted risk is still exposure; the acceptance only records that someone chose to carry it. Report accepted debt separately so the choice stays visible at review time instead of quietly disappearing from the metric.

Related Calculators

Security Debt Calculator – Calculate Security Debt