# Security Patch Compliance Calculator

> Work out the share of in-scope assets patched within your SLA, excluding approved exceptions, and how many more must be fixed to hit your target.

Category: IT, networking & security · Applies to: Worldwide · Last updated: 2026-10-29
Interactive calculator: https://calculators.geekmidst.com/calculators/security-patch-compliance-calculator

Patch compliance is the number of assets that are fully patched within your remediation window, divided by the assets measured. Approved exceptions are taken out of the denominator so they are neither counted as failures nor hidden as successes.

Also called: Patch coverage calculator.

## Inputs
- Assets in scope (default 500)
- Approved exceptions (default 20; optional)
- Assets patched within SLA (default 432)
- Target (unit %; default 95)

## Results
- Patch compliance
- Non-compliant assets
- Assets measured
- More assets to patch to reach target
- Gap to target

## Formula

```
Compliance % = Compliant ÷ (In scope − Exceptions) × 100;  To target = ⌈Target% × (In scope − Exceptions)⌉ − Compliant
```

Where:
- Compliant: assets with all required patches applied within the SLA window
- In scope: assets the policy applies to
- Exceptions: assets with approved risk acceptance

## Worked example
1. Assets measured = 500 − 20 = 480.
2. Compliance = 432 ÷ 480 = 90%.
3. 95% of 480 = 456, so 456 − 432 = 24 more assets must be patched.

**Result:** With 432 of 480 measured assets patched in time, compliance is 90%, and 24 more are needed to reach 95%.

## What the result means

Report the exceptions count alongside the rate: a high rate achieved by excluding many assets is weaker than it looks. Track critical-severity patches separately, since an average across severities can hide them.

## Assumptions and limits
- An asset counts as compliant only if every required patch was applied within the SLA.
- The rate says nothing about how long non-compliant assets have been exposed.

## Questions

### Should exceptions be in the denominator?

Practices differ. Excluding approved exceptions measures the remediation process; including them measures total exposure. State which you use, and report the exception count either way.

### What counts as “within SLA”?

Your policy decides, often by severity (for example days allowed for critical versus medium patches). Count an asset as compliant only if it met the window for every patch due.

## Related calculators
- [Cybersecurity Risk Score Calculator](https://calculators.geekmidst.com/calculators/cybersecurity-risk-score-calculator)
- [Phishing Simulation Rate Calculator](https://calculators.geekmidst.com/calculators/phishing-simulation-rate-calculator)
- [Percentage Calculator](https://calculators.geekmidst.com/calculators/percentage-calculator)

Source: GM¹X CalcVerse — https://calculators.geekmidst.com/calculators/security-patch-compliance-calculator