Help Center/Patch Report & Remediation Grade

Patch Report & Remediation Grade

A weekly, client-ready answer to "are we actually patched?", built from the same verified data as the rest of the product, with a letter grade that is deliberately hard to game.

The weekly Patch Report

Every week Patch Console snapshots the tenant into a report you can hand to a client or a manager: what was vulnerable, what was deployed, what verifiably resolved, what is overdue against its SLA, and how the fleet's grade moved. The report is print-friendly and works in light and dark themes.

The Remediation Grade

The grade is a single letter, A through F, computed from severity-weighted coverage: how much of the fleet's vulnerability exposure has been remediated, with critical findings weighing far more than low ones. Two caps keep it honest:

  • KEV cap. Open findings on the CISA Known Exploited Vulnerabilities list cap the grade. A fleet with a known-exploited hole cannot score an A, no matter how good the rest looks.
  • EOL cap. End-of-life software that can never be patched caps the grade as long as it stays on the fleet.

Grade bands

GradeReading
A / BHealthyExposure is remediated at a strong, severity-weighted rate with no open caps.
CNeeds attentionCoverage is slipping, or a cap (KEV, EOL) is dragging an otherwise better score down.
D / FCriticalSignificant unremediated exposure. The report's detail sections show exactly which groups are responsible.

SLA tracking

Every finding runs against a remediation deadline by severity. The defaults follow CISA remediation timeframes and are configurable per tenant:

SeverityDefault SLA
Critical14 days
High30 days
Medium60 days
Low90 days

The report shows what is inside, approaching, and past its SLA, so the week's priorities fall out of the table.

The time machine

Reports are kept per week. Pick any past week to see the fleet exactly as it stood then: the grade, the open findings, and what shipped that week. Trends across weeks show whether the program is winning.

Grades come from verified remediation only. A deployment that ran but never proved itself in inventory contributes nothing to the grade, by design.