Indicator formulas

Every figure in the Indicators tab of the Reports page, in the summary for management and in framework readiness has its formula. It is the same text as the ⓘ button next to the figure, in the seven interface languages. The code in backticks identifies the indicator.

Common rules:

every figure is compared with the previous period of the same length; below a base of 10, the change is written as a number (“+3”) rather than a percentage (“+200%”); a share changes in points;
a delay reads in bands (under 7 days, 7 to 30 days, 30 to 90 days, over 90 days), with the median, never an average alone;
a share without a denominator shows “—”, never 0%;
past figures can change when a case is reopened or reclassified: each case’s history and the audit log keep track of it;
no gauge, no pie chart, no donut: figures, trends and tables.

Detection

New detections

Code: nouvelles

Number of (project, vulnerability) pairs detected in the period: alert date, or case opening when there is no alert. Compared with the previous period of the same length; below a base of 10, the change is written as a number, not a percentage.

Of which exploited

Code: nouvelles_exploitees

Among new detections, those whose exploitation is observed: CISA KEV catalogue, VulnCheck KEV, CERT-FR alert or public exploit.

New detections by tier

Code: paliers_nouvelles

New detections broken down by SSVC / BOD 26-04 decision tier (3 days, 14 days, 60 days or deferred), tier calculated on the report date. “Undetermined”: case opened without an alert.

Median detection time

Code: delai_detection

Median, in days, of the time between the vulnerability’s publication and the alert. Catch-up alerts (component added after publication) are excluded.

Remediation

Vulnerabilities handled

Code: sorties

Cases closed in the period: fixed, not applicable or risk accepted. The closure date is the last entry into a closed status, the one shown on the case.

Net gap

Code: ecart_net

Detected − handled in the period (and per week). Positive: the backlog grows; negative: it shrinks.

Net resolve rate

Code: taux_net

Handled ÷ detected in the period. Above 100%, more is handled than discovered. Without detections, no figure. Change in points.

Time to fix from detection

Code: mttr_detection

For each case closed in the period: closure − detection, broken down into bands (under 7 d, 7 to 30 d, 30 to 90 d, over 90 d; exactly 7 d falls into “7 to 30 d”), with the median, never an average alone. “Not applicable” closures (false positives) are excluded.

Time to fix from patch availability

Code: mttr_correctif

Like the time from detection, but counted from the later of detection and patch availability: the date a fixed version became known; failing that, the vulnerability’s publication. A closure with no patch known before it is not measured.

Time to fix by tier

Code: mttr_palier

Time to fix from detection (false positives excluded), in bands and as a median, by the case’s current decision tier.

Deadlines met

Code: respect_echeances

Closures in the period made on or before their deadline (the project’s remediation policy: decision tier or severity) ÷ closures in the period. Approved accepted risks do not count; a fix made under a mitigation applied in time counts as on time. Same calculation as the Deadlines page.

Age of vulnerabilities to handle

Code: backlog

Vulnerabilities to handle today (case pending, under analysis, being fixed or not yet opened; accepted risks excluded), by age since detection, in the same bands as the time to fix.

Prevention

Components with a version

Code: versions_precises

Stack components (products) that carry a version ÷ components. Without a version, an alert cannot tell whether the installed version is affected.

Unsupported components

Code: fins_de_vie

Components past the vendor’s end of life, and the share of components nearing end of life that are covered by a dated exit plan.

Failing sources

Code: surveillance

Sources down or out of date: vulnerability feeds, inventory connectors, agents silent for 24 h (counted as one source). A zero reads as a zero only if detection has run.

Summary for management and readiness

Exploited, open

Code: exploitees_ouvertes

Vulnerabilities to handle whose exploitation is observed (KEV, CERT-FR, public exploit), accepted risks excluded, at the time of issue.

Overdue fixes

Code: hors_delai

Open vulnerabilities whose remediation-policy deadline has passed, escalated ones included.

Accepted exceptions

Code: exceptions

Approved risk acceptances in force in the risk register, each with its review date.

Vulnerabilities open at the end of each week

Code: ouvertes_semaine

Rebuilt backwards: open today − detected after the week + handled after the week. An intermediate reopening is not replayed.

Controls covered automatically

Code: controles_couverts

Framework requirements whose every measure is produced by the tool for the organisation (not outside the plan, not a document kept outside the tool) ÷ framework requirements.

Evidence present

Code: preuves_presentes

Requirements whose every measure has up-to-date evidence ÷ framework requirements. Strict rule: a single pending measure leaves the requirement without evidence, which can drop the share to 0%.