What share of your critical and high vulnerabilities was fixed within the deadlines you set?
That is what NIS2 and ISO 27001 ask an auditor to assess: your process, not your number of vulnerabilities. Wisec measures it over 90 days, and its full definition is public.
The day it was first detected, plus your target: 7 days for a critical, 30 for a high by default. The targets are yours, and every change is written to the audit log with the previous value.
Wisecdeadline = first detection + target for its severityEach line is a vulnerability, from detection to fix. A fix counts only if the scanner that reported it ran again and no longer sees it: removing a scanner fixes nothing.
100% means every deadline was met. Next to the figure, always: your targets, the scope, the accepted risks and the dismissed false positives.
The figure on screen follows your current settings. The monthly record freezes it when the month closes: signed, anchored on IPFS and logged in Rekor. Loosening a target later does not rewrite the past. First records: November 2026.
A figure handed to an auditor must be explainable without us. Every figure carries its version, and two versions do not compare.
Only projects that declare a scanner. A vulnerability reported by two tools counts once, at the highest severity.
7 and 30 days by default. A vulnerability that comes back keeps its original detection date.
A vulnerability that disappears because its scanner stopped running counts as late.
Over 90 days, rounded down. No figure before two weeks of history and three resolved findings.
Every move that would lift a naive indicator has an answer in the rule.
| Move | Why it does not work |
|---|---|
| Remove a scanner from the pipeline | Its findings are no longer observed, which counts as late, never as fixed. |
| Declare everything a false positive | The number of dismissed findings is shown next to the figure, and every decision is in the audit log. |
| Accept every risk | An accepted risk is set aside only until its review date, then it counts as late. |
| Set a 365-day target | Targets are printed with every figure, and every change is audited with the previous value. |
| Add a second scanner | A vulnerability counts once, whatever the number of tools that report it. |
| Rewrite past months | Each month is frozen in a signed record when it closes. |
The figure and its scope, vulnerabilities by severity, the scanner inventory of each project.
In the dashboard and as PDF, with the records of the months the report covers.
One signed statement per month, verifiable without a Wisec account, with standard tools.
Available on the Business and Pro plans. On the Free plan, the Exposure page shows whether the figure is still being established. The figure never appears on a build certificate: a certificate states facts, this figure describes a period.