Measuring an attack surface management program: metrics that show exposure going down

Why are finding counts a poor measure?

A finding count moves for reasons you do not control. FIRST forecast about 66,000 CVEs for 2026, up from a February median of about 59,427, so the number of version matches on your assets can rise every month even when your exposure falls. A count also rises when discovery improves, which is good news that looks like bad news. Report counts to the team that works them, not as a headline to leadership.

Which metrics show exposure going down?

1. Validated exposures open: exposures your tool or testers have shown to be exploitable on your assets, still not fixed or mitigated.
2. KEV matches open on internet-facing assets: CISA lists vulnerabilities with reliable evidence of exploitation, so an open match is a known risk.
3. Age of the oldest item in each of those two groups: an average hides the one exposure that has been open for months.
4. Ownership coverage: the share of internet-facing assets with a confirmed entity and owner.
5. Closure route: how many exposures closed by a patch, by a compensating control, or by taking the asset down.
6. Time to decision after a new CVE: for each affected internet-facing asset, the time from publication to a decision of exploitable, not exploitable or mitigated.

What about mean time to remediate?

Mean time to remediate, MTTR, is useful inside the team, per owner and per finding class, but it is easy to game: closing many easy findings quickly lowers the average while a hard one stays open. Pair it with the oldest-item age. Treat vendor MTTR figures as claims. IONIX says organizations report a 90% reduction in MTTR and Hadrian cites an 80% figure; we have not verified either, and they are not comparable because each vendor measures differently.

How should you report to leadership?

One page, four numbers and a trend: validated exposures open, KEV matches open, the age of the oldest in each, and ownership coverage. Add one line on what changed: an acquisition added assets, a new CVE was mitigated at the edge, or a subsidiary confirmed its inventory. That page answers the question leaders actually ask, which is whether the organization is safer than last quarter.

How do metrics connect to tool choice?

Some metrics depend on what the tool documents. Ownership coverage needs attribution to entities and owners. Validated exposures need validation. Closure by compensating control needs mitigation support or a clean hand-off to the team that runs your WAFs. Our findings table records which tools document an owner, proof of exploitability, a ticket, a compensating control and a retest, and the compare page shows them side by side.

This is the last lesson. The glossary defines every term used in the course, and the FAQ answers the questions we are asked most often.