Normalise vulnerability counts per asset and per thousand lines of code, with a severity-weighted density for fair comparison.
Raw counts only measure how much you scanned, which is why a team that doubles its coverage looks twice as insecure. Dividing by assets or code size removes that artefact, and the weighted variant stops a thousand informational TLS findings from masking eighteen criticals. Density is the only vulnerability count that survives estate growth and scanner rollout, so it is the number to trend on a quarterly slide.
Vulnerability Density
Density per asset = findings ÷ assets; density per KLOC = findings ÷ thousands of lines; severity-weighted density = (10 × critical + 5 × high + 1 × the rest) ÷ assets.
Benchmark comparison
Against benchmark = (your density − peer density) ÷ peer density, so +50% means half again as many findings per asset as your comparison group.
Density per asset = findings ÷ assets; density per KLOC = findings ÷ thousands of lines; severity-weighted density = (10 × critical + 5 × high + 1 × the rest) ÷ assets. Raw counts only measure how much you scanned, which is why a team that doubles its coverage looks twice as insecure. Dividing by assets or code size removes that artefact, and the weighted variant stops a thousand informational TLS findings from masking eighteen criticals.
Density is the only vulnerability count that survives estate growth and scanner rollout, so it is the number to trend on a quarterly slide.
This calculator takes 6 inputs: Open findings, Assets in scope, Codebase size, Of which critical, Of which high, Peer benchmark density. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Per asset for infrastructure scopes and per KLOC for application or code-scanning scopes. Mixing them in one figure is meaningless, because a monolith with 500 KLOC on two hosts and a fleet of 500 hosts running packaged software have nothing in common.
Enormously. One vulnerable library shipped in 200 containers is one problem with 200 instances. Count instances for exposure and unique defects for engineering effort, and always say which you are reporting.