Security Metrics Dashboard

Here is where security posture stands going into the review. You have 342 open vulnerabilities across the estate, down from 361 last month, and they are heavily weighted toward the lower end: 12 critical, 58 high, 164 medium, and 108 low. Patch coverage sits at 96% against a 95% target, the phishing-report rate climbed to 68%, and there are 3 open incidents. The one number moving the wrong way is mean time to remediate on critical findings, now 21 days.

The open vulnerabilities break down by severity like this, and the shape is healthy — the twelve critical findings are the ones that set the pace of the review.

Mean time to remediate on critical vulnerabilities is the metric to watch. It has drifted from 16 days to 21 over the quarter and is now six days past the 15-day target. The cause is not intake — criticals are being triaged the day they land — it is the gap between a fix being ready and a change window to deploy it. Four of the twelve open criticals have an approved patch that is simply waiting on the next maintenance window, which is what is dragging the average out. Nothing else is off target: patch coverage held above its bar, phishing reporting is up seven points as the last campaign’s training landed, and the incident queue is the shortest it has been all year.

If you want to bring the critical remediation time back under target before quarter-end, the lever is the change cadence rather than the security team — an out-of-band window for those four ready patches would clear most of the overage on its own.