Skip to content
VOC.

07 · VOC area

Metrics & Reporting

What you measure shapes what teams do. This area defines the metrics that matter — time to remediate, SLA compliance, coverage, exposure windows for exploited vulnerabilities — shows how to compute them, and how to turn them into a report executives can act on.

Guides in this area

  1. Vulnerability management metrics that matter

    Define and compute the metrics a VOC needs: time to remediate with percentiles, SLA compliance, coverage, backlog age, KEV exposure windows and reopen rate.

  2. Communicating vulnerability risk to leadership

    How a VOC reports to executives and the board: audiences, a one-page structure, KRIs vs KPIs, trends over snapshots, and what to leave out.