Skip to content

Outcomes & Executive Summary

Audience: All client users (what you see is scoped to the assessments you can access) · Where: Analytics → Outcomes in the sidebar (/analytics/outcomes), and the Executive summary PDF button on the Dashboard and the Outcomes page.

Overview

The other Analytics views describe where your risk is today. Outcomes shows what your security program achieved over a period: how much risk you reduced, how many findings you closed, how fast you fixed them, whether you met your SLA targets, and how much of your estate was tested. Each figure is compared with the period before, so you can show progress to leadership.

You can also turn the same numbers into a shareable executive summary PDF.

Choosing the period

Three controls sit at the top right of the page:

  • Period: 3, 6, 12 or 24 months. The default is 12.
  • Compare to previous period: on by default. Each headline figure shows its change against the period of the same length just before (for example vs previous 12 mo). If that earlier period has no data, the page says "No data in the previous N months to compare against."
  • Executive summary PDF: see below.

The period and comparison setting are kept in the page URL, so you can bookmark or share a specific view.

Headline figures

Figure What it measures
Risk reduced How much the severity-weighted open backlog shrank between the start and the end of the period. Negative when it grew.
Findings closed Findings that moved to Fixed or Accepted Risk during the period. The comparison uses closures per day, because the current period runs to today and is shorter than the full previous period.
Mean time to remediate Average time from a finding first becoming visible to it being fixed, over the findings fixed in the period. Lower is better.
SLA compliance Share of critical, high, medium and low findings fixed in the period that were fixed within your SLA targets.
Retest pass rate Share of retests in the period that confirmed the fix. Inconclusive retests count against the rate.
Test coverage Share of your active internal and external assets tested in the recent coverage window, either by a completed pentest that observed the asset or by a vulnerability scan that covered it to completion.

Hover over a figure for its exact definition. Percentage figures show their change in percentage points (pts). A move from 40% to 50% is "+10 pts", not "+25%".

The charts and tables

  • Opened vs closed

    Findings opened and closed each month. The current month is partial.

  • Exposure trend

    Your severity-weighted open backlog at each month end (critical 10, high 5, medium 3, low 1), alongside your security score. Lower is better.

  • SLA compliance

    Share of findings fixed each month within their SLA target.

  • SLA by severity

    Per severity: fixed within SLA, fixed, compliance %, open findings breaching their target right now (Open breaching), and total open.

  • Time to remediate by severity

    Mean days to fix per severity, for findings fixed in the period. Hover for the median.

  • Attack-surface growth

    New assets discovered per week.

  • Retest outcomes

    Retests in the period split into Fixed, Still vulnerable and Inconclusive.

  • Test coverage

    Assets tested vs active assets, with the coverage window in days.

Each card has an export button that downloads its underlying numbers as CSV.

Estimates (not measured)

A separate section at the bottom shows a Manual effort estimate: the analyst hours the automated work stands in for. It is a rough figure, not a measurement. Each recorded tool action (a scan, a probe, a credential test) is counted at a fixed number of minutes, and the card shows the formula it used. It is kept apart from the measured figures above.

Limited access

If your access is limited to specific assessments, organization-wide asset metrics (test coverage, attack-surface growth and security score) are not shown, because they are measured across all of the organization's assets.

If no assessment has produced findings yet, the page shows "No outcome data yet".

Executive summary PDF

The executive summary is a short PDF built from your outcome figures, written for leadership or a board. You can generate it from two places:

  • Dashboard: covers the last 12 months.
  • Analytics → Outcomes: covers the period you have selected.

Any member of the organization can generate one.

  1. Click Executive summary PDF. The button changes to Generating… and a message confirms that generation has started. It usually takes under a minute.
  2. When it's ready, you'll see "Your executive summary is ready." and the button changes to Download executive summary.
  3. Click it to download the PDF.

If generation fails, the button changes to Retry executive summary. Changing the period starts over with a fresh summary.

Things to know

  • Each click takes a fresh snapshot of your figures at that moment.
  • The summary covers only the assessments you can access, so only the person who generated it can download it. Colleagues generate their own.
  • The executive summary is separate from an assessment's pentest report. For those, see Reports.

MSSPs and pentest firms

Firms can also generate a portfolio executive summary covering every client. See Portfolio & Reporting.

Related: Analytics · Home Dashboard · SLA Targets · Reports