Engineering Security Metrics Operational

Vulnerability Count

Vulnerability Count: Number of known vulnerabilities still open in your systems.

Formula

Vulnerability Count = Count of open vulnerabilities at period end

Computable definition

The canonical formula in the GASP formula grammar. The MCP server compiles it to SQL over the datasets listed below.

count_distinct(field.vulnerability_id where field.vulnerability_status = 'open')

Unit: count

Notes: Categorised by severity (critical, high, medium, low).

Data requirements

Grain: Daily snapshot · Frequency: Daily · Aggregation: snapshot (day) · Staged: no · Main source: Security Scanner.

Field	Dataset	Type
`snapshot_date`	vulnerability	date
`vulnerability_id`	vulnerability	string
`vulnerability_status`	vulnerability	string

Example SQL (Postgres)

SELECT (SELECT COUNT(DISTINCT vulnerability_id) FROM vulnerability WHERE snapshot_date = :period_end AND vulnerability_status = 'open') AS vulnerability_count

From an agent: with the GASP MCP server, call lookup_metric({ "name": "Vulnerability Count" }) or generate_query({ "metric": "Vulnerability Count", "adapter": "<your adapter JSON>" }).

← Back to Engineering metrics