Skip to content
ENExplore Calculators

Vulnerability Density Calculator

Normalise vulnerability counts per asset and per thousand lines of code, with a severity-weighted density for fair comparison.

About Vulnerability Density Calculator

Raw counts only measure how much you scanned, which is why a team that doubles its coverage looks twice as insecure. Dividing by assets or code size removes that artefact, and the weighted variant stops a thousand informational TLS findings from masking eighteen criticals. Density is the only vulnerability count that survives estate growth and scanner rollout, so it is the number to trend on a quarterly slide.

Formulas

Vulnerability Density

Density per asset = findings ÷ assets; density per KLOC = findings ÷ thousands of lines; severity-weighted density = (10 × critical + 5 × high + 1 × the rest) ÷ assets.

findings
Open, deduplicated vulnerability instances
assets
Hosts, containers or services in the scanned scope
KLOC
Thousands of lines of code
10 / 5 / 1
Severity weights

Benchmark comparison

Against benchmark = (your density − peer density) ÷ peer density, so +50% means half again as many findings per asset as your comparison group.

Worked example

With the default values below, Vulnerability Density Calculator returns Findings per Asset of 1.50. Change any input above and every figure here is recalculated in your browser.

Inputs used

Open findingsaccepts 0–1,000,000 findings
480 findings
Assets in scopeaccepts 1–1,000,000 assets
320 assets
Codebase sizeaccepts 1–100,000 KLOC
250 KLOC
Of which criticalaccepts 0–1,000,000 findings
18 findings
Of which highaccepts 0–1,000,000 findings
64 findings
Peer benchmark densityaccepts 0–1,000 per asset
1.2 per asset

Results

Findings per Asset
1.50 per asset
Findings per KLOC
1.920 per KLOC
Severity-Weighted Density
2.81 per asset
Critical and High Share
17.1%
Against Benchmark
25.0%
Interpretation
Moderate — density is manageable with a steady cycle

Step by step

  1. 1Values used
  2. 2Vulnerability Density
  3. 3Benchmark comparison
  4. 4Findings per Asset= 1.50 per asset
  5. 5Findings per KLOC= 1.920 per KLOC
  6. 6Severity-Weighted Density= 2.81 per asset
  7. 7Critical and High Share= 17.1
  8. 8Against Benchmark= 25.0
  9. 9Interpretation= Moderate — density is manageable with a steady cycle

Assumptions and limits

  • The result is derived only from the 6 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 3 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Vulnerability Density calculated?

Density per asset = findings ÷ assets; density per KLOC = findings ÷ thousands of lines; severity-weighted density = (10 × critical + 5 × high + 1 × the rest) ÷ assets. Raw counts only measure how much you scanned, which is why a team that doubles its coverage looks twice as insecure. Dividing by assets or code size removes that artefact, and the weighted variant stops a thousand informational TLS findings from masking eighteen criticals.

Why does Vulnerability Density matter?

Density is the only vulnerability count that survives estate growth and scanner rollout, so it is the number to trend on a quarterly slide.

What values do I need to enter?

This calculator takes 6 inputs: Open findings, Assets in scope, Codebase size, Of which critical, Of which high, Peer benchmark density. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Per asset or per KLOC?

Per asset for infrastructure scopes and per KLOC for application or code-scanning scopes. Mixing them in one figure is meaningless, because a monolith with 500 KLOC on two hosts and a fleet of 500 hosts running packaged software have nothing in common.

Does deduplication matter?

Enormously. One vulnerable library shipped in 200 containers is one problem with 200 instances. Count instances for exposure and unique defects for engineering effort, and always say which you are reporting.

Related Calculators

Vulnerability Density Calculator | Calcrivo