Calculate Average age (days) of known critical vulnerabilities

InsightVM
1

Hello,

Is there a way that I can calculate the ​Average age (days) of known critical vulnerabilities within environment. Is there any SQL query or Dashboard card that can provide the information?

Regards,

2

@john_hartman Could you help me with the query?

3

There are cards called “Average Days to Remediate By CVSSv3 Severity Ratings” or “Average Days to Remediate By Severity” in the Dashboard card library. However this just looks at all severities and averages them out without displaying the individual vulnerabilities.

For a SQL Query you would need to look at the finding date of the vulnerability and calculate the time to now. This would give you the amount of time that something has been vulnerable per asset and then you could average it out per all assets vulnerable.