Measure, Share, Compare.

Distribution by Vulnerability ID illustrates the relative concentration of vulnerabilities in the environment. This scorecard displays the total number of occurrences for each unique vulnerability ID.

Hosts Exempt from Vulnerability Scanning presents trended metrics results for the percentage of hosts exempt from vulnerability scanning. Grouped by Asset Scope

Hosts Scanned within Policy illustrates the organization's adherence to vulnerability scanning policies. This scorecard presents trended metrics results for the percentage of hosts scanned within the time frame specified by user-defined policy. Grouped by Asset Scope

Hosts With No Vulnerabilities presents trended metrics results for the percentage of hosts with no vulnerabilities detected. Grouped by Asset Scope

Hosts With Severe Vulnerabilities presents trended metrics results for the percentage of hosts with severe vulnerabilities detected. Grouped by Asset Scope

Host Vulnerability Distribution shows the distribution of vulnerabilities across hosts.

Mean Age of Open Tickets presents trended metrics results for support ticket aging. Grouped by Asset Scope

Mean Time Since Last Scan presents trended metrics results for the average number of days since the last vulnerability scan. Grouped by Asset Scope

Mean Time to Close a Ticket illustrates the activity time for remediation support tickets. This scorecard presents trended metrics results for the mean number of days between support ticket initiation and ticket closure. Grouped by Asset Scope

Most Common Vulnerabilities lists the ten vulnerabilities with the most number of instances detected across all hosts.

Open Tickets by Month Created illustrates seasonal changes and spikes in the vulnerability scanning process. This scorecard shows support ticket aging grouped by ticket creation month. Grouped by Asset Scope

This scorecard demonstrates compliance with PCI Data Security Standard Requirement 11. The scorecard presents trended metrics results for vulnerability scanning, tracking average time since last scan and adherence to scanning policy. Grouped by Asset Scope

This scorecard demonstrates compliance with PCI Data Security Standard Requirement 6. The scorecard presents trended metrics results for the percentage of hosts covered by vulnerability scans. Grouped by Asset Scope

Percentage of Hosts Scanned presents trended metrics results for percentage of hosts covered by a vulnerability scanning system. Grouped by Asset Scope

Percentage of Vulnerable Hosts presents trended metrics results for percentage of hosts with at least one detected vulnerability. Grouped by Asset Scope

Remediation Activity displays statistics for vulnerability remediation process time and remediation ticket duration. This scorecard presents trended metrics results for average process time, process time within policy, average ticket close time, and ticket close time within policy. Grouped by Asset Scope

Residual Risk Level displays statistics for ticket processing. This scorecard presents trended metrics results for open patching tickets and for ticket aging. Grouped by Asset Scope

Scan Configuration illustrates the organization's adherence to vulnerability scanning policies. This scorecard presents trended metrics results for mean days since last scan, and for percentage of hosts scanned within the time frame specified by user-defined policy. Grouped by Asset Scope

Scan Coverage illustrates host coverage by an automated vulnerability scanning system. This scorecard displays trended metrics results for hosts covered by vulnerability scanning, hosts exempt from scanning, hosts with severe vulnerabilities, and hosts with no known vulnerabilities. Grouped by Asset Scope

Time to Process in Policy illustrates the organization's adherence to policy for overall remediation process time, from identification of the issue to closure. This scorecard presents trended metrics results for the percentage of vulnerabilities remediated within user-defined policy. Default policy is 45 days. Grouped by Asset Scope

Vulnerabilities by Impact shows the distribution of vulnerabilities classified by impact rating.

Vulnerabilities by Type shows the distribution of detected vulnerabilities classified by vulnerability type.

Vulnerability Count by Impact displays the total number of detected vulnerabilities grouped by impact rating.

Vulnerability Coverage Rollup by Asset Scope evaluates the exposure of hosts not being monitored by a vulnerability scanning system.

Vulnerability Management presents the distribution of detected vulnerabilities. This scorecard displays metrics results for vulnerabilities classified by impact and type, and lists the most common vulnerabilities detected. Grouped by Asset Scope

The Vulnerability Statistics Rollup by Asset Scope scorecard illustrates the organizations overall vulnerability management performance. This scorecard displays aggregate information collected in other metrics and scorecards, as defined in the Rollup configuration.illustrates the organizations overall vulnerability management performance. This scorecard displays aggregate information collected in other metrics and scorecards, as defined in the Rollup configuration.

Fully Patched Hosts scorecard examines the percentage of hosts under patch management that are fully patched.

The chart displays the percentage of hosts exempt from patch management.

The chart displays a list of hosts missing critical patches. Missing critical patches are patches with a not installed status and a severity value over 4.

The Patch Application scorecard examines the number and mean time to install patches.

Patch Application Policy examines how well the organization applies patches within the organization. The scorecard focuses on two policies: the percentag e of patches applied within policy and the time to apply patches.

Patched Hosts examines how well the organization's host are up-to-date on their patches. The scorecard examines the following policies: percentage of hosts fully patched and the list of hosts missing critical patches.

Patches Applied Within Policy displays the percentage patches applied within policy.

Patch Management Coverage presents statistics for host coverage by an automated patch management system. This scorecard displays trended metrics results for patched systems and exemptions.

This scorecard communicates the coverage of hosts by an automated patch management system by presenting the performance score for a key performance indicator: assets covered by a patching system. Scores are based on user-defined goals. Performance scores are trended and displayed as RYG rating visuals.

The Patch Management Host Coverage metric calculates the percentage of hosts covered by the patch management system. The metric does not include hosts excluded from coverage.

This scorecard communicates the coverage of hosts by an automated patch management system by presenting the performance scores for two key performance indicators: percentage of hosts fully patched and percentage of patches applied within policy. Scores are based on user-defined goals. Performance scores are trended and displayed as RYG rating visuals.

Time to Apply Patches displays statistics on the amount of time to patch. Patch time is measured as the number of days from when the patch was released to last status update with a patch status of installed.

This scorecard demonstrates compliance with PCI Data Security Standard Requirement 6. The scorecard presents trended metrics results for the percentage of hosts covered by vulnerability scans.