Security Debt Calculator

Debt = Σ over severities of count × severity weight (10 critical, 5 high, 1 medium) × (1 + average age in days ÷ 365), so a year-old finding counts double. The age factor is what makes this debt rather than a backlog count: an eighteen-month-old critical is worth two and a half of the same finding raised yesterday, because the exposure has been continuous and the fix has usually got harder as the system drifted. Monthly interest is the debt the backlog adds just by existing, which is the number to compare against your closure rate.

Framing unpatched vulnerabilities as debt with interest gets engineering leadership to fund reduction campaigns, where a list of 272 open findings gets filed and forgotten.

This calculator takes 7 inputs: Open criticals, Average age of open criticals, Open highs, Average age of open highs, Open mediums, Average age of open mediums, Blended engineering cost. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

They are averages for patch-and-verify work on managed systems. Findings needing a code change, a vendor upgrade or a migration cost far more, so track those separately — a handful of them can outweigh the entire routine backlog.

Yes, at full weight. An accepted risk is still exposure; the acceptance only records that someone chose to carry it. Report accepted debt separately so the choice stays visible at review time instead of quietly disappearing from the metric.