Question 1

What is SLA breach aging distribution?

Accepted Answer

SLA breach aging distribution is the shape of how long open vulnerability findings stay in a breached state, measured as a population rather than per finding. Each open finding that has crossed its remediation SLA window enters the breach population on the day it crosses. Each breached finding leaves the population on the day it closes through remediation, on the day it leaves through a recorded risk acceptance, on the day it is reclassified out (a false positive, a duplicate-of-record retirement, or an asset-decommissioning closure), or on the day it leaves through an SLA reset tied to a documented severity recalibration. The distribution captures how the population shape behaves over time: median time-since-breach, the body of the distribution per severity band, the tail length, the new-breach inflow rate, the exit-route mix, and the breach-to-closure half-life. A programme reading only the headline percentage past SLA sees a single number that smooths over the population shape; the distribution view surfaces whether the breached cohort is moving or aging in place.

Question 2

How is breach aging distribution different from MTTR, throughput, and patch-cycle mismatch?

Accepted Answer

The four frames sit at different layers of the same lifecycle. Mean time to remediate measures the per-finding clock from open to closed across the full population. Vulnerability remediation throughput measures closure-side cycle time by stage across the lifecycle. Patch-cycle-versus-remediation-SLA mismatch measures the structural cadence gap between when a vendor patch becomes available and when the SLA expires. Breach aging distribution sits on the post-breach population that the three metrics each summarise away. Programmes that report only MTTR and throughput see a population trend without a breach-tail decomposition; programmes that report only the patch-cycle mismatch see the cadence cause without the population effect. The breach aging distribution names the effect: how long the breached cohort persists, how its severity mix shifts, and how it exits the population. The four frames are complementary; the breach aging distribution closes the post-breach gap the other three do not see.

Question 3

What are the canonical exit routes that drain the breach population?

Accepted Answer

Five canonical exits drain the breach population, and each carries a different audit citation. Closure via verified remediation, where the fix shipped, the rescan confirmed the finding is no longer present, and the closure event captured the rescan evidence on the same record as the original finding (the cleanest exit; the audit reads against the chain of detected, accepted, remediated, verified). Closure via formal risk acceptance, where the security committee or named accepting decision-maker documented the residual-risk acceptance with a named approver, a stated rationale, an expiry date, and a re-review trigger; the finding remains in the inventory but exits the breach population for the duration of the acceptance. Closure via finding override, where the finding was reclassified as a false positive, a duplicate-of-record retirement, or an out-of-scope artefact through a documented override decision; the audit citation reads the override rationale. Closure via asset decommissioning, where the affected asset was retired and the finding closes because the surface no longer exists; the audit citation reads the asset retirement evidence. Closure via severity recalibration to a state where the SLA window is no longer breached, where a CVSS re-score or an environmental modifier shifted the severity band such that the original breach calculation no longer applies; this exit is the most contested and the audit citation must read the recalibration evidence rather than an implicit re-anchor. Each exit produces a different leadership read; reporting the exit mix surfaces whether the breach population is draining through remediation discipline or through documentary reclassification.

Question 4

What does a healthy breach aging distribution look like by severity?

Accepted Answer

A healthy distribution is severity-aware rather than uniform. The critical-severity breach band runs hot and drains fast: a small population with a short median time-since-breach (single-digit days for KEV-aligned, low double-digit days for non-KEV critical), a 90th percentile that does not extend past two to four weeks, and an exit mix dominated by verified remediation rather than risk acceptance. The high-severity breach band runs warmer and drains on a regular cadence: a moderate population with a median time-since-breach in the low double-digit days, a 90th percentile under sixty days, and an exit mix that mixes verified remediation with documented risk acceptance for the longer-lead-time findings. The medium-severity breach band typically carries the long tail: a larger population with a median time-since-breach in the double-digit to low triple-digit days, a 90th percentile that can extend past six months, and an exit mix that is heavier on risk acceptance and override decisions because the cost-benefit calculation tilts more often. The low-severity breach band tends to drain into reclassification, decommissioning, and bundled-fix releases. The shape is not the same across programmes; the shape is the diagnostic. A flat distribution across severities indicates that the SLA windows were set without severity calibration. An inverted distribution (mediums aging less than criticals) indicates a routing or acknowledgement gap upstream. The distribution shape names the structural issue without naming the individual finding.

Question 5

How is the breach population measured on the live record?

Accepted Answer

The breach population is measured as a function of the live record at each query, not as a static snapshot. The query reads the open finding catalogue, joins each finding to its SLA window through the severity band and the policy reference, and filters to the breached subset (current date minus open date exceeds the SLA window). The cohort is then grouped by time-since-breach buckets (zero to seven days past, eight to thirty days past, thirty-one to ninety days past, ninety-one to one hundred eighty days past, one hundred eighty-one to three hundred sixty-five days past, more than three hundred sixty-five days past) and by severity band. The exit-route ledger reads against the activity log: each closed finding carries the closure event (verified remediation, risk acceptance, finding override, asset decommissioning, severity recalibration) with a named actor and a timestamp. The breach inflow rate is the count of findings crossing the SLA window per observation period; the breach outflow rate is the count of breached findings leaving the population per observation period through any exit route. The breach-to-closure half-life is the median time from breach event to exit event across the cohort. Programmes that read these numbers from the live record produce a distribution that regenerates from the working data; programmes that derive them from quarterly exports produce a distribution that lags the operational reality by the export cadence.

Question 6

What failure modes inflate the breach population without showing up in the headline metric?

Accepted Answer

Six failure modes inflate the breach population while the headline metric (percentage past SLA) holds steady. The reclassification leak, where breached findings exit the population through severity recalibration that resets the SLA window without a documented rationale, masks a remediation gap; the headline metric reads healthy while the same finding could re-enter on the next scan. The override leak, where breached findings are marked false-positive or duplicate without contestation, masks a triage gap; the breach population looks lower while the underlying exposure persists. The risk-acceptance leak, where breached findings exit through unsigned, unbounded, or non-renewed risk acceptances, looks like exit but reads as audit-week debt; the breach is invisible to the working dashboard but visible to the auditor. The decommissioning leak, where assets are reported decommissioned without confirming the surface is truly retired, looks like exit but the finding can re-enter on the next scan against the same surface. The cohort-aging leak, where the breach population drifts older without exiting because the cohort sits at the median while new breaches enter from the inflow side, looks like a stable headline while the tail extends. The reset leak, where SLA windows are tacitly extended through policy re-anchoring without revising the SLA policy in change-control, looks like the breach window closed but actually moved the goalpost. Reading the exit-route mix alongside the breach inflow rate surfaces these leaks; reading only the percentage past SLA hides them.

Question 7

How does breach aging distribution interact with risk acceptance discipline?

Accepted Answer

Risk acceptance is the legitimate non-remediation exit, but the discipline determines whether the exit is healthy or rotten. A healthy risk acceptance exits the breach population on a recorded date with a named accepting decision-maker, a stated residual-risk justification, an expiry date that anchors a re-review, and an attached compensating-control posture if one applies. The accepted finding remains in the inventory and the activity log captures the decision; the breach distribution reads the exit as a documented event rather than an unobserved drift. A rotten risk acceptance exits the breach population through an implicit decision (the finding stops being escalated, no comment is added, no expiry is set, no approver signs); the cohort drains the headline metric while the audit citation for risk treatment is silently broken. Programmes that pair the breach aging distribution with the risk-acceptance ledger surface the discipline gap; programmes that report the breach metric in isolation conceal it. The risk-acceptance-decay-rate research covers the second-order question of how recorded acceptances decay between renewals; the breach aging distribution covers the first-order question of whether the acceptance was recorded at all.

Question 8

Which compliance frameworks expect breach reporting alongside closure reporting?

Accepted Answer

Most enterprise frameworks read against the discipline of identifying, tracking, and remediating vulnerabilities with documented exception handling rather than naming an explicit breach metric. The audit citation reads stronger when the programme reports breach population and exit mix alongside closure rate because the audit query against assigned responsibility and timely remediation is satisfied by the underlying record. ISO 27001:2022 Annex A 8.8 reads management of technical vulnerabilities with timely, risk-justified handling; the audit reads against the chain of detection, decision, and remediation captured on the operating record. SOC 2 Trust Services Criteria CC7.1 reads detection and remediation of vulnerabilities; the breach population and exit ledger directly support the discipline citation. PCI DSS v4.0 Requirement 6.3.3 reads ranking and addressing high-severity vulnerabilities within one month and supporting evidence; Requirement 12.10.6 reads the corrective action and lessons-learned discipline. NIST SP 800-53 Revision 5 SI-2 reads flaw remediation with named accountability and timely action; CA-7 reads continuous monitoring with reporting against the discipline. NIST CSF 2.0 DE.CM continuous monitoring outcomes and RS.MA response management outcomes both read the breach population and the exit chain. CIS Controls v8.1 safeguard 7.5 reads the vulnerability remediation process with documented exceptions. DORA Article 9 ICT risk management and Article 17 ICT-related incident management both read the response cadence captured on the live record. The pattern across frameworks is the same: the audit reads against a chain of timestamped events with named exit reasons rather than against a single closure-rate number.

Question 9

How does breach aging distribution get reported to leadership?

Accepted Answer

The leadership view pairs five numbers on the same dashboard the operational team reads against. Breach population size by severity (the count of currently breached findings per severity band). Time-since-breach distribution by severity (median, 75th percentile, 90th percentile, and 95th percentile time-since-breach buckets per severity band, plotted as a histogram or as cumulative-distribution curves). Breach inflow rate per period (the count of findings newly crossing the SLA window per week, month, or quarter, decomposed by severity and by origin scanner or engagement). Breach outflow rate per period and exit mix (the count of breached findings exiting per period, decomposed by exit route, so the leadership view sees whether the breach population is draining through verified remediation or through reclassification). Breach-to-closure half-life per severity (the median time from breach event to exit event across each severity cohort). Reporting these alongside open-finding aging, severity distribution, and overall closure throughput places the breach population on the same operating record as the rest of programme reporting and surfaces structural issues before they become audit findings or board-level surprises. The board read benefits from the distribution shape and the exit mix more than from the headline percentage past SLA because the shape names the lever and the mix names the discipline.

Question 10

When does a growing breach population signal a capacity gap versus a discipline gap?

Accepted Answer

The signal decomposes by reading three numbers in proportion. When the breach inflow rate exceeds the breach outflow rate and the closure throughput is stable, the structural cause is most often a capacity gap: the team is closing the work it can absorb but the inflow is overwhelming the capacity. The intervention sits on the inflow side (deduplication discipline, severity calibration, scanner-output normalisation, ingest-versus-capacity rebalancing covered in the ingest-versus-remediation-capacity research). When the breach inflow rate is stable but the outflow rate is dropping and the exit mix is shifting from verified remediation toward risk acceptance and override, the structural cause is most often a discipline gap: the team is documenting exits more than producing them. The intervention sits on the discipline side (risk-acceptance renewal cadence, override evidence requirements, retest scheduling cadence, exception register currency). When the breach population is stable but the time-since-breach distribution is extending, the structural cause is most often a cohort-aging gap: a long tail of older findings is sitting in place while new entries cycle through. The intervention sits on the cohort-aging side (named tail-cleanup sweeps, severity recalibration with documented rationale, asset-decommissioning reconciliation). Reading the three numbers together surfaces the lever; reading only the headline metric forces the team to guess.

Question 11

How does breach aging interact with cloud and SaaS findings?

Accepted Answer

Cloud and SaaS findings shift the breach distribution in three ways. The remediation lever is partially or fully outside the customer organisation, so the breach population for SaaS-managed findings reads as vendor-side cadence rather than as internal capacity. The breach exit routes for these findings include vendor advisory closure (the vendor shipped the fix and the customer-observable surface confirms the patch landed) and vendor risk acceptance (the customer organisation accepts the residual exposure of the vendor delay through a documented record). The breach aging distribution per origin (internally owned versus vendor managed) surfaces which side of the boundary carries the breach load. Cloud-native findings against IaaS or PaaS surfaces sit between the two: the customer has more remediation levers than for SaaS but less than for an internal application, so the exit mix typically includes more risk acceptance for windows that depend on the cloud provider control plane. Reading the breach distribution decomposed by origin lets the programme attribute the breach load to the side that actually carries the capacity to act, and the leadership read separates internal-discipline gaps from vendor-side cadence issues.

Question 12

How does SecPortal help internal teams read the breach aging distribution from the live record?

Accepted Answer

SecPortal pairs every finding to a versioned engagement record so the SLA timer, the severity band, the named owner, the activity log, the override decisions, and the retest events live on the same record the breach query reads against. Findings management captures the CVSS 3.1 vector, the severity band, the asset binding, and the structured state enumeration; the immutable created-at timestamp on the finding is t0 for the breach calculation. Engagement management groups findings to a versioned engagement record so the per-engagement breach view stays consistent across reporting cycles. The activity log with CSV export captures the timestamped chain of state changes, ownership reassignments, and override decisions by user, so the breach inflow, the breach outflow, and the exit mix can be reconstructed from the live record at any audit-week query or steering review. Finding overrides for accepted-risk, false-positive, and exception reasons capture the named decision-maker, the rationale, and the override status, so the exit ledger reads as documented events rather than as inferred drift. Retesting workflows pair to the original finding so the breach clock keeps running on the original date and the closure event is the rescan confirmation rather than the deployment notice. Compliance tracking maps findings and controls to ISO 27001, SOC 2, Cyber Essentials, PCI DSS, NIST, and additional framework catalogues with CSV export, so the per-framework breach citation reads against the same finding record. Continuous monitoring schedules feed the recurring detection stream that triggers new breach events. AI report generation summarises the breach cadence on the engagement record without inventing data so the leadership view reads against the live activity log. The platform does not write the breach discipline for the team; it does make the breach population, the time-since-breach distribution, the inflow and outflow rates, and the exit mix observable from the live record at any moment between reporting cycles.

Axis	What it reads	What it signals
Breach population by severity	Count of currently breached findings per severity band on the live record.	Absolute load per band; surfaces capacity versus discipline imbalance when read against historical baseline.
Time-since-breach distribution	Median, 75th, 90th, and 95th percentile time-since-breach per severity band, plotted as histogram or cumulative distribution.	Cohort aging; surfaces a stretching tail before the population count changes.
Breach inflow and outflow rates	Findings newly crossing the SLA window per period; breached findings exiting per period across all exit routes.	Population dynamics; surfaces whether the breach load is growing, shrinking, or churning at a stable size.
Exit-route mix	Share of breach exits by route: verified remediation, formal risk acceptance, finding override, asset decommissioning, severity recalibration.	Discipline mix; surfaces whether the breach population is draining through remediation work or through documentary reclassification.

Exit route	Trigger	Audit citation
Verified remediation	Fix shipped, rescan confirmed the finding is no longer present, closure event captured the rescan evidence on the same record.	Cleanest exit; the audit reads the chain of detected, accepted, remediated, verified with timestamps and a named verifier.
Formal risk acceptance	Named accepting decision-maker recorded the residual-risk acceptance with rationale, expiry date, and re-review trigger; finding stays in inventory.	Documented exception; the audit reads the named approver, the rationale, and the renewal cadence.
Finding override	Reclassified as a false positive, duplicate-of-record, or out-of-scope artefact through a documented override decision.	Override rationale; the audit reads the override evidence and the named overriding actor.
Asset decommissioning	Affected asset was retired; finding closes because the surface no longer exists.	Asset retirement evidence; the audit reads the decommissioning record and the surface-no-longer-present verification.
Severity recalibration	CVSS re-score or environmental modifier shifted the severity band such that the SLA window is no longer breached.	Most contested exit; the audit reads the recalibration rationale and the named decision-maker; an undocumented re-score reads as a moved goalpost.

Framework	Relevant control	What the audit reads against
ISO 27001:2022	Annex A.8.8 Management of Technical Vulnerabilities; A.5.4 Management Responsibilities; A.5.37 Documented Operating Procedures	Defined process for handling technical vulnerabilities with assigned responsibilities and documented exception handling; the audit reads against the chain of detection, decision, and remediation captured on the operating record.
SOC 2 (TSC 2017 with 2022 revisions)	CC7.1 Detection of Vulnerabilities; CC9.1 Risk Mitigation; CC4.1 Monitoring of Controls	Detection, monitoring, and remediation of vulnerabilities with documented exception handling; the audit reads the chain of identified, ranked, evaluated, and remediated findings against the policy cadence.
PCI DSS v4.0	Requirement 6.3.3 Vulnerability Ranking and Remediation Within Defined Periods; 12.10.6 Corrective Action and Lessons-Learned	Vulnerabilities ranked and addressed within defined timeframes; corrective-action discipline read against the breach population and the exit ledger.
NIST SP 800-53 Rev. 5	SI-2 Flaw Remediation; CA-7 Continuous Monitoring; PM-9 Risk Management Strategy; RA-7 Risk Response	Flaw remediation with named accountability and timely action; continuous monitoring with reporting against the discipline; risk response with documented exception handling.
NIST CSF 2.0	DE.CM Continuous Monitoring; RS.MA Response Management; GV.RR Governance Roles and Responsibilities	Continuous monitoring outcomes paired with response management cadence and named governance roles; the audit reads the response chain captured on the live record.
CIS Controls v8.1	Safeguard 7.1 Establish a Vulnerability Management Process; 7.4 Perform Automated Application Patch Management; 7.5 Perform Automated Vulnerability Scans	Vulnerability management process with documented remediation and exception handling; the safeguards read against assigned cadence and named accountability.
DORA (EU 2022/2554)	Article 9 ICT Risk Management Framework; Article 17 ICT-Related Incident Management Process	ICT risk management framework with documented response cadence; the audit reads the breach population and the exit ledger against the operational record.
CISA BOD 22-01	Reducing the Significant Risk of Known Exploited Vulnerabilities (KEV) within fixed windows	KEV-aligned findings remediated within the directive window; the breach population for KEV-listed CVEs is the most heavily-read citation against the directive.

SLA Breach Aging Distribution: How Breached Vulnerabilities Age in the Backlog

Why the headline percentage past SLA hides the breach population shape

Four measurement axes for the breach population

The five canonical exit routes that drain the breach population

Six failure modes that inflate the breach population invisibly

Reclassification leak

Override leak

Risk-acceptance leak

Decommissioning leak

Cohort-aging leak

Reset leak

How frameworks read against the breach discipline

How breach distribution interacts with adjacent metrics

Reporting breach aging distribution to leadership

Five numbers on the breach distribution dashboard

Operational checklist for instrumenting breach aging distribution

How the engagement record carries the breach distribution

Conclusion

Frequently Asked Questions

Sources

Measure breach aging distribution on the live engagement record