Lion Cipher Lab
Measure vulnerability-remediation SLA attainment and build a KRI
- GRC / Compliance
- Intermediate
- ~45 min
- Free · no account required
Why it matters
A vulnerability-management program is only as good as whether the fixes actually land on time -- and 'on time' has to be a number you can defend, not a feeling. That number is remediation-SLA compliance: an SLA (Service Level Agreement) is the fix window you commit to for each severity (a common shape is critical within 7 days, high within 30, medium within 90), and compliance is the share of findings resolved -- or still comfortably open -- inside that window. Most teams either never compute it or compute one flattering overall average that hides the criticals. This lab makes you compute the…
What you'll learn
- turning a raw vulnerability-scanner export (a CSV of findings) into an OPERATIONAL security metric instead of leaving it as a pile of rows
- defining a remediation SLA per severity (critical = 7 days, high = 30, medium = 90) and computing days-to-close for resolved findings and days-open-so-far for still-open ones
- measuring remediation-SLA compliance per severity and overall, and reading a poor number honestly (criticals at 60%) rather than hiding behind an overall average
- weighting compliance by asset criticality (crown-jewel 3, important 2, commodity 1) so a missed deadline on a crown-jewel counts more than one on a throwaway box
- building a Key Risk Indicator (KRI): a single metric with a threshold that trips RED when risk exceeds appetite -- here, weighted overdue-critical exposure against a threshold of 6
- producing a before/after operational result: a remediation sprint closes the overdue criticals and a re-run shows compliance and the KRI both move (critical compliance 60% -> 100%, KRI 9 -> 0, RED -> GREEN)
- naming how the metric is gamed -- closing a ticket without a real fix, excluding accepted-risk items, cherry-picking easy lows to lift the average -- and the controls that catch it (reopen-rate, a sample audit)
- reporting the honest tail a single percentage hides: the oldest still-open finding (a 182-day medium) that a healthy-looking average conceals
- writing all of this in Python 3 standard library only (csv, datetime, collections) -- no pip, no paid API, fully offline
Steps in this lab
- SLA, compliance, and a KRI -- in one breath
- Set up: Python, a folder, and a synthetic scanner export
- Measure the BEFORE number
- Weight by asset criticality and raise a KRI
- When this metric drives good behaviour -- and when it lies
- What you built -- and the reflex to keep