This analytics page presents remediation KPIs, such as MTTR (Mean Time to Remediation), average daily remediated/introduced vulnerabilities, and campaign coverage, generating a bigger picture of the remediation workload capacity in your organization. You can filter the report to present data on all your organization or on selected Busines Groups.

First, make sure you cover the Analytics Filters and Data Drilling to learn about the expected behavior of the trends and presented data.

The Remediation KPIs are the first and main widgets you encounter when entering the Remediation Performance Analytics report.

What each KPI represents?

The campaign coverage graph shows the % of vulnerability instances linked to remediation campaigns over time by Risk Level. You should strive to have all the vulnerability instances most important to you (e.g., Critical/High) covered by remediation campaigns.

For example, if we look at the date 03/20/2022, we can tell that 40% of the Critical-risk vulnerability instances were covered in the remediation campaigns running on that date. If we look at the rest of the % division, we also learn that 29.5% of the High-risk vulnerability instances were linked to remediation campaigns on that date.

See it in action:

Using the "Has Campaign" filter

We've also added a special filter called "Has Campaign" to help you view data only on vulnerability instances covered by campaigns. In the example below, we use the "Has Campaign" filter and the Risk Level filter to show valuable data, such as MTTR, only on Critical vulnerability instances covered by campaigns.

Look at the average daily remediation by business groups and how their rank shifts (Current vs. Previous Rank). The more remediations done on vulnerability instances in a Business Group, the higher the rank climbs for that Business Group.

Let's look at the example below, assuming we've set the Period filter to compare the "Last 30 Days" with the 30 days before it:

Look at your business groups with the highest MTTR (Mean Time to Remediation) and how their rank shifts (Current vs. Previous Rank).

Let's look at the example below, assuming we've set the Period filter to compare the "Last 30 Days" with the 30 days before it:

This graph presents a straightforward trend that focuses on the shifts in MTTR over the days, within the range of the selected Period of time.

You can use the data-drilling buttons to drill up and down.

Mean Time to Remediate in days per each risk level: None, Low, Medium, High, and Critical.

You should always strive for the lowest MTTR for the higher risk levels.

Tip: Click on a severity level to present more focused data across the other MTTRs.

MTTR by Risk (focused view) - Watch Video

Mean Time to Remediate in days per each asset type in the Vulcan Platform: Website, Host, Code Project, Image, and Cloud Resource.

This trend indicates to you what type of assets takes the most time to remediate.

Mean Time to Remediate in days of vulnerability instances that are vs. aren't covered in campaigns.

The MTTR of vulnerability instances covered in campaigns is significantly lower than those with no attached campaigns.

This graph shows a numeric trend of newly introduced vulnerability instances (i.e., newly identified by the Vulcan Platform) vs. remediated vulnerability instances. This trend offers a perspective on how much is getting done in remediation actions.

Let's look at the following data point and learn how the Remediation / Introduced KPI can be quickly calculated.

Divide the number of remediated vulnerability instances by the number of introduced vulnerability instances.
​For example: 17,497 (Remediated) / 24,648 (Introduced) = 0.70... = your Workload capacity on that day was 70%.

Your security team workload capacity was less than the 100%+ goal. Keep in mind that you should always be remediating more vulnerabilities than introduced.

Following the calculation example above, if you click on the calculated data point on the Campaign Coverage graph, the Remediated / Introduced KPI should show ~70%:

On top of that, we offer you another graph that automatically calculates the Remediation Capacity Delta. Based on the example above, the delta of the same data point is -7,151. It means that there are 7,151 vulnerability instances left in a vulnerable state on that date.

Let's see it in action:

This trend shows the % of Remediated / Introduced when calculated per Risk Level. In the example below, 1200% of the introduced critical vulnerability instances get remediated. This means that the remediation capacity is mainly dedicated to fixing Critical vulnerabilities.

This trend shows the % of Remediated / Introduced when calculated per Asset Type. In the example below, 52% of the remediation capacity is carried on Code Project type of assets, and only 7% on Images.

Read our Analytics FAQ and Data Validation article here.