Metrics Methodology
Understanding our security research metrics and how we calculate impact
Overview
Our metrics are calculated from real-world security assessments and vulnerability research. Each metric is derived from the actual impact, scope, and business context of findings, providing an accurate representation of security work performed and risk mitigated.
Total Assessments
Counts all completed security assessments across different engagement types.
Includes:
- • Bug bounty submissions
- • Coordinated vulnerability disclosures
- • Security assessments
- • Penetration testing engagements
- • Code reviews and security audits
Estimated Annualized Risk Reduction
This is the cornerstone metric that quantifies the financial impact of security improvements. It calculates the estimated annual loss prevented by fixing vulnerabilities, using the industry-standard Annual Loss Expectancy (ALE) model.
Core Formula: ALE Model
Risk = SLE × ARO
SLE: Single Loss Expectancy
The estimated financial loss from one successful exploitation of the vulnerability
ARO: Annual Rate of Occurrence
The estimated number of times the vulnerability would be exploited in one year (as a decimal: 0-1)
Risk Reduction Calculation
Risk Mitigated = (SLE × Initial ARO) - (SLE × Residual ARO)
Initial ARO: Likelihood before the fix (how often would it be exploited without the fix)
Residual ARO: Likelihood after the fix (remaining risk even with remediation in place)
Practical Example: Data Exposure Vulnerability
VULNERABILITY DETAILS
Type: Unauthenticated Data Exposure
Impact: Customer database accessible
Records: 100,000 customers
FINANCIAL IMPACT
Per Record: $150 (GDPR fines + costs)
Total SLE: $15,000,000
BEFORE FIX
ARO: 0.8 (highly likely to be discovered/exploited per year)
Risk = $15,000,000 × 0.8 = $12,000,000/year
AFTER FIX
ARO: 0.01 (unlikely, ~once per century)
Risk = $15,000,000 × 0.01 = $150,000/year
RISK MITIGATED
$11,850,000/year
Why This Matters
• This metric represents the actual financial value of the security work performed
• It's not hypothetical—it's based on documented business impact and real remediation
• Organizations use this to justify security spending and understand ROI
• Higher ARO values reflect vulnerabilities that are actively targeted (publicly known exploits, in CVSS above 7.0, etc.)
• Lower residual ARO reflects the effectiveness of the remediation
Years of Experience
Total years spent in application security research, including vulnerability analysis, security consulting, and independent research.
Experience Areas:
- • OWASP Top 10 and beyond
- • Web application security
- • API security
- • Mobile application security
- • Secure code review
- • Threat modeling
Organizations Assisted
Unique organizations that have engaged in security assessments, including enterprises, startups, and government agencies across multiple industries.
Each organization represents a unique engagement with tailored assessment scope, industry-specific risks, and business-critical applications.
Verified Fixes
Vulnerabilities that have been successfully remediated and verified as fixed through follow-up testing or confirmation from the organization.
Verification Process:
- • Initial vulnerability identified and documented
- • Severity and business impact assessed
- • Remediation plan provided
- • Organization implements fix
- • Follow-up testing confirms vulnerability is no longer exploitable
Vulnerability Severity Classification
Vulnerabilities are classified using a risk-based approach considering impact, exploitability, and scope.
Critical (CVSS 9.0-10.0)
Immediate exploitation possible, severe business impact. Requires urgent remediation.
Examples: Unauthenticated RCE, Complete database exposure, Authentication bypass
High (CVSS 7.0-8.9)
Likely exploitation with significant impact. Should be addressed within weeks.
Examples: SQL Injection, XSS with session hijacking, Privilege escalation
Medium (CVSS 4.0-6.9)
Possible exploitation with moderate impact. Include in next release cycle.
Examples: Information disclosure, CORS misconfiguration, Weak encryption
Low (CVSS 0.1-3.9)
Limited impact or unlikely exploitation. Address with other improvements.
Examples: Missing security headers, Verbose error messages, Outdated dependencies
Key Performance Indicators
Critical Issues Resolved
Count of Critical and High severity vulnerabilities identified and successfully remediated, reflecting the quality and impact of findings.
Reports Acknowledged
Percentage of findings that have been formally acknowledged by the organization, demonstrating engagement and commitment to remediation.
Average Engagement Duration
Average time from engagement start date to completion or latest update, calculated from case study metadata.
Engagement Status
Verified (confirmed fixed), Pending (awaiting remediation), or In Progress (ongoing assessment) - indicates the current state of each finding.
Data Sources & Calculation
All metrics are automatically calculated from verified case studies stored in GitHub and fetched at runtime.
Case Study Metadata Includes:
- • engagement.status: "Verified", "Pending", "In Progress"
- • engagement.startedAt, closedAt: Date strings (DD-MM-YYYY)
- • risk.singleLossExpectancy: Financial impact ($)
- • risk.annualRateOfOccurrence: Initial risk likelihood (0-1)
- • risk.residualAnnualRateOfOccurrence: Risk after fix (0-1)
- • risk.currency: Currency code (USD, KES, etc.)
- • findings: Array of vulnerabilities with severity
- • organization.name: Company name
- • industry: Business sector
Calculation Process:
- 1. Fetch all case studies from GitHub repository
- 2. For each case study, extract metadata
- 3. Calculate ALE for each case study with risk data
- 4. Sum across all case studies by currency
- 5. Count unique organizations, verified fixes, critical issues
- 6. Display real-time metrics on dashboard
Transparency & Verification
All metrics are derived from real security assessments documented in detailed case studies. While sensitive information like specific URLs and affected customers is redacted for privacy, the numerical metrics and risk calculations are based on verified data from actual engagements. Each case study provides documented proof of findings, remediation status, and business impact.