How to use this calculator
- Enter or choose assets in scope.
- Enter or choose approved exceptions.
- Enter or choose assets patched within SLA.
- Enter or choose target.
- The patch compliance updates as you type. Use Copy result or Share to keep it.
Method
Compliance % = Compliant ÷ (In scope − Exceptions) × 100; To target = ⌈Target% × (In scope − Exceptions)⌉ − Compliant
- Compliant
- assets with all required patches applied within the SLA window
- In scope
- assets the policy applies to
- Exceptions
- assets with approved risk acceptance
Worked example
- Assets measured = 500 − 20 = 480.
- Compliance = 432 ÷ 480 = 90%.
- 95% of 480 = 456, so 456 − 432 = 24 more assets must be patched.
With 432 of 480 measured assets patched in time, compliance is 90%, and 24 more are needed to reach 95%.
What the result means
Report the exceptions count alongside the rate: a high rate achieved by excluding many assets is weaker than it looks. Track critical-severity patches separately, since an average across severities can hide them.
Assumptions and limits
- An asset counts as compliant only if every required patch was applied within the SLA.
- The rate says nothing about how long non-compliant assets have been exposed.
Questions
Should exceptions be in the denominator?
Practices differ. Excluding approved exceptions measures the remediation process; including them measures total exposure. State which you use, and report the exception count either way.
What counts as “within SLA”?
Your policy decides, often by severity (for example days allowed for critical versus medium patches). Count an asset as compliant only if it met the window for every patch due.