Work out vulnerability backlog burn down instantly with clear inputs, formula shown and shareable results.
A vulnerability backlog behaves like a queue: it shrinks only when the remediation rate exceeds the discovery rate. The net rate is what determines burn-down time, and when discovery outpaces remediation no amount of prioritisation clears the queue — it only changes which items wait. That is the argument for automated patching and for reducing the inflow through hardened base images.
Backlog burn-down
net rate = remediated per week - new per week; weeks to clear = open / net rate (only meaningful while net rate is positive)
Because inflow scales with asset count and scan coverage. Adding scanners or assets raises discovery, so remediation capacity has to grow with the estate.
Patch golden images rather than running instances, remove unused packages, shorten instance lifetimes so rebuilds pick up fixes, and consolidate onto fewer distinct software versions.