A team can discover more vulnerabilities and appear to perform worse, or suppress detection and appear to improve. Raw counts reward the wrong behaviour because they confuse visibility with risk.
Measure coverage first
Report which assets, technologies and services are assessed with appropriate depth and freshness. Findings have meaning only inside a known denominator.
Measure priority flow
Track time to validate, assign, treat and verify the highest-priority exposures. Show blocked work, accepted risk and recurrence separately.
Measure outcomes and learning
Use reduction in known exploited exposure, attack-path removal, control improvement and root-cause prevention. Automation should reduce manual handling while increasing evidence quality.
Practical next steps
- Retire standalone total-vulnerability targets.
- Report inflow and validated closure by Signal band.
- Track ageing and blockers for material exposure.
- Use recurrence to fund preventive engineering.
Continue the decision