Vulnerability Backlog Burn Down Calculator

Work out vulnerability backlog burn down instantly with clear inputs, formula shown and shareable results.

About Vulnerability Backlog Burn Down Calculator

A vulnerability backlog behaves like a queue: it shrinks only when the remediation rate exceeds the discovery rate. The net rate is what determines burn-down time, and when discovery outpaces remediation no amount of prioritisation clears the queue — it only changes which items wait. That is the argument for automated patching and for reducing the inflow through hardened base images.

Formula

Backlog burn-down

net rate = remediated per week - new per week; weeks to clear = open / net rate (only meaningful while net rate is positive)

Worked example

With the default values below, Vulnerability Backlog Burn Down Calculator returns Weeks to clear the backlog of 53.3. Change any input above and every figure here is recalculated in your browser.

Inputs used

Open vulnerabilitiesminimum 1: 3,200
Remediated per weekminimum 1: 180
New findings per weekminimum 0: 120

Results

Weeks to clear the backlog: 53.3 weeks
Net reduction per week: 60.0
Backlog at the end of that period: 0
Trend: Backlog shrinking - clears in about 12.3 months

Step by step

1Values used
2Backlog burn-down
3Weeks to clear the backlog= 53.3 weeks
4Net reduction per week= 60.0
5Backlog at the end of that period= 0
6Trend= Backlog shrinking - clears in about 12.3 months

Assumptions and limits

The result is derived only from the 3 inputs listed above. Anything not among them is not part of the calculation.
In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
Figures are rounded for display to 1 decimal place, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

Why does the backlog keep growing despite more patching?

Because inflow scales with asset count and scan coverage. Adding scanners or assets raises discovery, so remediation capacity has to grow with the estate.

How can inflow be reduced?

Patch golden images rather than running instances, remove unused packages, shorten instance lifetimes so rebuilds pick up fixes, and consolidate onto fewer distinct software versions.