Vulnerability Management Maturity Calculator

Rate six vulnerability-management domains 1–5 and get a weighted maturity score, a level, your weakest domain and the next step.

About Vulnerability Management Maturity Calculator

The four heavily weighted domains form a dependency chain: you cannot scan what is not inventoried, cannot prioritise what is not scanned, and cannot remediate what is not prioritised. Automation and metrics carry half the weight because they multiply an existing capability rather than create one — automating a programme with a broken inventory just produces wrong tickets faster. Maturity scoring turns 'we should do better at patching' into a ranked list of investments, and the weakest-domain output usually contradicts the domain the team wanted to spend money on.

Formulas

Vulnerability Management Maturity

Score = (20 × inventory + 20 × scanning + 20 × prioritisation + 20 × remediation + 10 × automation + 10 × metrics) ÷ 5, giving 0–100 from six 1–5 ratings.

20-point domains: Inventory, scanning, prioritisation and remediation — the four that decide outcomes
10-point domains: Automation and metrics — force multipliers rather than prerequisites
÷ 5: Converts the 100–500 weighted points to a 20–100 percentage

Maturity levels

Levels: below 36 Initial, 36–55 Repeatable, 56–71 Defined, 72–87 Managed, 88+ Optimising.

Worked example

With the default values below, Vulnerability Management Maturity Calculator returns Maturity Score of 54.0%. Change any input above and every figure here is recalculated in your browser.

Inputs used

Asset inventory and ownershipone of 1 — No reliable inventory, 2 — Spreadsheet, partly stale, 3 — CMDB with known gaps, 4 — Reconciled from multiple sources, 5 — Continuous discovery with named owners: 3 — CMDB with known gaps
Scanning coverage and depthone of 1 — Ad hoc scanning, 2 — Unauthenticated periodic scans, 3 — Authenticated scans on most assets, 4 — Agents plus authenticated scans, weekly, 5 — Continuous, all layers including code and cloud: 3 — Authenticated scans on most assets
Risk-based prioritisationone of 1 — CVSS only, 2 — CVSS plus manual judgement, 3 — CVSS with asset criticality, 4 — EPSS and KEV joined to asset criticality, 5 — Automated, exploit-aware, business-context driven: 2 — CVSS plus manual judgement
Remediation and SLA disciplineone of 1 — No SLAs, 2 — SLAs defined, not measured, 3 — Measured, frequently breached, 4 — Measured and largely met, 5 — Met consistently with verified closure: 3 — Measured, frequently breached
Automation and integrationone of 1 — Manual spreadsheets and email, 2 — Tickets raised by hand, 3 — Automated ticketing, 4 — Automated ticketing and patch orchestration, 5 — Closed loop with verification and auto-rescan: 2 — Tickets raised by hand
Metrics and governanceone of 1 — No reporting, 2 — Ad hoc counts, 3 — Regular operational reporting, 4 — Trended KPIs reviewed by management, 5 — Board-level risk reporting driving investment: 3 — Regular operational reporting

Results

Maturity Score: 54.0%
Maturity Level: Level 2 — Repeatable
Grade: D — Weak
Weighted Points: 270.0 of 500
Weakest Domain: Risk-based prioritisation
Next Step: Join EPSS and KEV to asset criticality so the queue is ordered by real risk

Step by step

1Values used
2Vulnerability Management Maturity
3Maturity levels
4Maturity Score= 54.0
5Maturity Level= Level 2 — Repeatable
6Grade= D — Weak
7Weighted Points= 270.0 of 500
8Weakest Domain= Risk-based prioritisation
9Next Step= Join EPSS and KEV to asset criticality so the queue is ordered by real risk

Assumptions and limits

The result is derived only from the 6 inputs listed above. Anything not among them is not part of the calculation.
In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
Figures are rounded for display to 1 decimal place, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Vulnerability Management Maturity calculated?

Score = (20 × inventory + 20 × scanning + 20 × prioritisation + 20 × remediation + 10 × automation + 10 × metrics) ÷ 5, giving 0–100 from six 1–5 ratings. The four heavily weighted domains form a dependency chain: you cannot scan what is not inventoried, cannot prioritise what is not scanned, and cannot remediate what is not prioritised. Automation and metrics carry half the weight because they multiply an existing capability rather than create one — automating a programme with a broken inventory just produces wrong tickets faster.

Why does Vulnerability Management Maturity matter?

Maturity scoring turns 'we should do better at patching' into a ranked list of investments, and the weakest-domain output usually contradicts the domain the team wanted to spend money on.

What values do I need to enter?

This calculator takes 6 inputs: Asset inventory and ownership, Scanning coverage and depth, Risk-based prioritisation, Remediation and SLA discipline, Automation and integration, Metrics and governance. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Should I aim for Level 5 everywhere?

No. Level 4 across inventory, scanning, prioritisation and remediation beats Level 5 in one domain and Level 2 in another, because the chain is only as strong as its weakest link. Balance first, then optimise.

How often should this be reassessed?

Twice a year, with the same rater and the same evidence standard. Self-assessment drifts upward, so require evidence for any rating of 4 or 5 — a report, a coverage figure, a rescan record.