Vulnerability Density Calculator

Normalise vulnerability counts per asset and per thousand lines of code, with a severity-weighted density for fair comparison.

Inputs

Open findingsfindings

Assets in scopeassets

Codebase sizeKLOC

Thousands of lines of code, for application scopes

Of which criticalfindings

Of which highfindings

Peer benchmark densityper asset

Findings per Asset

1.50per asset

Findings per KLOC

1.920per KLOC

Severity-Weighted Density

2.81per asset

Critical and High Share

17.1%

Against Benchmark

25.0%

Interpretation

Moderate — density is manageable with a steady cycle

Step by step

Values used
Open findings = 480 findings; Assets in scope = 320 assets; Codebase size = 250 KLOC; Of which critical = 18 findings; Of which high = 64 findings; Peer benchmark density = 1.20 per asset
Vulnerability Density
Density per asset = findings ÷ assets; density per KLOC = findings ÷ thousands of lines; severity-weighted density = (10 × critical + 5 × high + 1 × the rest) ÷ assets.
Benchmark comparison
Against benchmark = (your density − peer density) ÷ peer density, so +50% means half again as many findings per asset as your comparison group.
Findings per Asset
= 1.50 per asset
Findings per KLOC
= 1.920 per KLOC
Severity-Weighted Density
= 2.81 per asset
Critical and High Share
= 17.1
Against Benchmark
= 25.0
Interpretation
= Moderate — density is manageable with a steady cycle

How it works

Raw counts only measure how much you scanned, which is why a team that doubles its coverage looks twice as insecure. Dividing by assets or code size removes that artefact, and the weighted variant stops a thousand informational TLS findings from masking eighteen criticals. Density is the only vulnerability count that survives estate growth and scanner rollout, so it is the number to trend on a quarterly slide.

Formulas

Vulnerability Density

Density per asset = findings ÷ assets; density per KLOC = findings ÷ thousands of lines; severity-weighted density = (10 × critical + 5 × high + 1 × the rest) ÷ assets.

findings: Open, deduplicated vulnerability instances
assets: Hosts, containers or services in the scanned scope
KLOC: Thousands of lines of code
10 / 5 / 1: Severity weights

Benchmark comparison

Against benchmark = (your density − peer density) ÷ peer density, so +50% means half again as many findings per asset as your comparison group.

Frequently Asked Questions

How is Vulnerability Density calculated?

Density per asset = findings ÷ assets; density per KLOC = findings ÷ thousands of lines; severity-weighted density = (10 × critical + 5 × high + 1 × the rest) ÷ assets. Raw counts only measure how much you scanned, which is why a team that doubles its coverage looks twice as insecure. Dividing by assets or code size removes that artefact, and the weighted variant stops a thousand informational TLS findings from masking eighteen criticals.

Why does Vulnerability Density matter?

Density is the only vulnerability count that survives estate growth and scanner rollout, so it is the number to trend on a quarterly slide.

What values do I need to enter?

This calculator takes 6 inputs: Open findings, Assets in scope, Codebase size, Of which critical, Of which high, Peer benchmark density. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Per asset or per KLOC?

Per asset for infrastructure scopes and per KLOC for application or code-scanning scopes. Mixing them in one figure is meaningless, because a monolith with 500 KLOC on two hosts and a fleet of 500 hosts running packaged software have nothing in common.

Does deduplication matter?

Enormously. One vulnerable library shipped in 200 containers is one problem with 200 instances. Count instances for exposure and unique defects for engineering effort, and always say which you are reporting.

You might also need

Scanner Coverage Calculator Security Debt Calculator Attack Surface Calculator