There is no universal acceptable number. A raw count mixes trivial and serious items. Track instead how many exploited or exposed items are open, and how old your oldest one is. A small team can set a simple goal such as zero exploited items older than a week, and review the rest by age.
Why the total count misleads
Open alerts rise when advisories are published, when you add a dependency and when you enable a tool on an old repository. None of that says your risk changed. FIRST's EPSS FAQ notes that most CVEs score near zero for exploitation likelihood because exploitation is rare, which is one reason a high count can look worse than it is.
Three numbers worth tracking
| Metric | Why |
|---|---|
| Open items on the exploited list that affect what you run | Highest signal. Aim for none past your deadline |
| Age of the oldest exposed item | Shows whether your routine works |
| Share of deferred items with a written reason and date | Shows whether you are deciding or ignoring |
Add a fourth if you like: number of repositories without scanning, because zero alerts from an unscanned repository is not good news.
How to set your own limits
- Look at your current state honestly.
- Choose a goal you could hit within a month, such as no exploited item older than seven days.
- Choose a looser goal for exposed items, such as thirty days.
- Leave internal items on the calendar.
- Review the numbers in your monthly slot and tighten when you comfortably meet them.
The specific days are your choice. The point is that they are written down and checked.
Avoid vanity targets
Hitting zero total alerts by dismissing everything proves nothing. A reviewer will look at reasons and dates. Equally, do not cut your tool's coverage to make the number smaller.
How to report it
One line per month: exploited open, oldest exposed item in days, deferrals with reasons. This reads well to customers and to your own future self. NIST's patch management guide stresses making patching routine and better at reducing risk, which these numbers directly measure.
Quick check
Is zero alerts a realistic target?
Rarely, because new advisories keep arriving. Zero overdue exploited items is realistic.
Should I report counts to customers?
Share process and timelines you actually meet. Avoid promising numbers you cannot keep.
Safeguard dependency scanning and vulnerability tracking can show age and exploitation status together, and the free scan is at gold.safeguard.sh/scan.
Sources
- FIRST EPSS FAQ
- NIST SP 800-40 Rev. 4, Guide to Enterprise Patch Management Planning
- CISA Known Exploited Vulnerabilities Catalog
Last reviewed: 19 October 2026.
