An SLA compliance percentage tells you how many items met the deadline, not how badly the rest missed it. Pair it with days overdue for the late items, a list of the worst cases, and an exception count. Together these show whether late means a day or a year.
The arithmetic problem
Say you close 100 findings in a quarter and 95 met the SLA. The report shows 95 percent. If the five misses are a few days late, that is fine. If one of them is a critical on an internet facing service that is 300 days overdue, the percentage does not tell you.
A rate is a count of events. It carries no information about size. That is why it is good for trend and poor for risk.
What to add
Days overdue distribution. For items past SLA, show median and maximum days overdue. Plot a histogram if you can.
Worst five list. Name the five oldest overdue items with asset, owner and plan. A short list gets read; a large table does not.
Exception count and age. Show how many items have an approved extension or accepted risk, and how long each has been in that state. Exceptions that never expire are a quiet way to improve the rate.
Share by tier. One overall percentage mixes tiers. Report compliance separately for items with exploit evidence, then for the rest.
Set thresholds that mean something
Instead of a single target like 90 percent, set different expectations by tier. For items with confirmed exploitation, anything overdue is a red flag, so the target is zero overdue, not a percentage. For lower tiers, a percentage target is reasonable.
If you use a known exploited list to set the top tier, check how often it changes. CISA's catalog, for instance, describes itself as an input to prioritisation and carries a due date field per entry. Use it as a signal and write your own policy on top.
Watch denominators
Compliance rate depends on what is in the denominator. If findings are closed as false positives, accepted, or removed, decide whether they count. If you close difficult items by marking them accepted, the rate goes up and nothing improves. See age of open findings.
A sample summary line
"Critical, exploited: 0 overdue. Critical, other: 92 percent in SLA, 3 overdue, oldest 41 days, owner named. 6 active exceptions, oldest 70 days, all with expiry."
That one paragraph says more than a gauge dial.
Make overdue items cost something visible
A metric that nobody reads does not change behaviour. Put the worst overdue items in the weekly engineering channel or planning meeting with owner names. This is not about blame. It is about making sure each item has a plan, and a date when it will be fixed or formally accepted.
Also check the reverse case. If compliance is low but all misses are by a day or two, the problem may be an unrealistic SLA rather than a stuck team. The overdue distribution lets you tell these cases apart before you change anything.
Quick check
Is a lower compliance rate always worse?
Not if scope grew or detection improved. Annotate those changes and read the rate with the overdue distribution.
What should happen to long overdue items?
Escalate to a named owner with a date: fix, mitigate, or formally accept with an expiry.
Sources
Last reviewed: 19 October 2026.
