Vulnerability Health Score Calculator

Health = 0.25 × MTTP component + 0.25 × SLA compliance + 0.20 × coverage + 0.15 × open-critical component + 0.15 × backlog-age component, plus a trend adjustment of ±8. Speed and discipline carry half the score between them because they are what actually shortens exposure; coverage is next because a finding you never see cannot be counted in either. The two backlog terms are deliberately harsh — one critical open for a year drags the score more than a dozen opened last week — and the trend adjustment stops a snapshot from hiding a programme that is quietly losing ground.

One defensible number that decomposes into five drivers is what gets vulnerability management onto a management dashboard without a fortnightly argument about which metric to show.

This calculator takes 6 inputs: Critical MTTP, SLA compliance, Effective scan coverage, Open criticals, Age of the oldest open critical, Backlog trend over the last quarter. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

On its own, yes. It works because every component is published alongside it, so the conversation moves straight to the weakest driver instead of stalling on methodology. Never report the score without its components.

Because it matches the critical SLA most regulated organisations commit to, and it is achievable with automated patch orchestration. Change it if your own SLA differs — the component simply penalises three points per day beyond whatever benchmark you set.