Tracking Each Client’s Risk and Mean Time to Remediate
Each client’s issues across every engagement, one row per issue: what is open and overdue against your targets, mean time to remediate, the trend by quarter, and ATT&CK and OWASP Top 10 mapping.
A single report says what was found on one engagement. A client that has been tested every year wants to know something else: whether its exposure is shrinking, how long its fixes take, and which issues keep coming back. The Risk Register answers that from the findings already in your database, for every client, with nothing to run or schedule.
Where it is
Risk Register is in the navigation. It opens on every client with something on it, ordered by what is overdue, each with its open issues by severity, its overdue count, its mean time to remediate and how many it had open a year ago. Choose a client there, from the list at the top of the page, or with Open the register on the client’s own page.
It is off until you turn it on: an administrator switches on Risk Register under Settings, Feature Modules.
One row per issue
Findings of different engagements that are one issue are one row: findings the finding library knows as the same issue, or findings with the same title. A row says how many engagements reported it, its severity, its status, its owners and hosts, when it was first reported, and when it is due or was closed. Opening a row lists each engagement’s finding with its date, severity and status, and opens it.
- An issue is open while any finding of it is open or part remediated.
- It is Remediated once every finding of it is, and Risk accepted when every finding of it was accepted.
- An issue reported again after it was remediated is marked Found again after a fix, and has a filter of its own.
When an issue counts
A finding joins the register when its report goes out to the client, or when it is released to the client before that. A finding on an engagement still being tested waits, and the page says how many are waiting. Time to remediate runs from the day the report went out to the day the finding was marked remediated, a date the database records whenever a finding is closed.
Targets and what is overdue
Each severity has a target for remediation, counted from the day the issue was reported: 14 days for critical, 30 for high, 90 for medium and 180 for low unless you change them with Targets. An open issue past its target is overdue, and the register says by how many days.
The four figures
| Figure | What it counts |
|---|---|
| Open issues | issues open now, by severity, and the change since the end of the last quarter |
| Overdue | open issues past the target for their severity |
| Mean time to remediate | the average days from report to fix, over the last 12 months, for critical and high as well as overall |
| Fixed within target | the share of findings remediated in the last 12 months that met their target |
Trends by quarter
Three charts cover up to twelve quarters, over the last three years:
- Open issues at the end of each quarter, stacked by severity.
- Found and fixed each quarter. An issue counts as found in the quarter it became open, for the first time or again after a fix, and as fixed in the quarter it was remediated.
- Mean days to remediate, each quarter.
MITRE ATT&CK and the OWASP Top 10
Below the register, the open issues are laid out by MITRE ATT&CK tactic, each with the techniques the finding library gives that issue, and by OWASP Top 10 category, from each issue’s CWE, for the 2025 edition or the 2021 one. The page says how many open issues each map covers.
Excel, and what the client sees
Excel, above the register, downloads it with two sheets: Risk register, one row per issue, and By quarter, the figures behind the charts.
Clients see their own register in their portal, read only and without targets to change. Untick Show clients their own risk register in their portal under Targets to keep it to your firm.
Owners come from the asset inventory. For the issues a client decides not to fix, see when a client accepts the risk instead of fixing it.
Open a Client’s Register on the Trial
Deliver two engagements for one client on the trial and open Risk Register to see their issues as one list, with what is overdue and how long fixes take.
Only need the reporting? Our reporting tool is free and open source, on your own server.
Also Worth Reading
What Your Clients Actually See in the Portal
The client portal shows a client their own engagements, the findings you release, the documents you deliver and the checklists you share, and nothing else. What is on each screen, and what controls it.
WorkflowImporting Scanner Output as Findings
Bring Nessus, Burp, OpenVAS, Qualys, Nmap or SARIF exports into a phase of an engagement as findings, one file or several at once: one for each issue with every host listed, in your library’s wording where it has the issue, and nothing written until you have seen it.
WorkflowChecklists and Runbooks for Every Phase of a Pentest
A methodology library of 22 checklists and 21 runbooks, from OSSTMM and PTES to OWASP and MITRE ATT&CK, suggested on each kind of phase once added, ticked by your testers, shown to the client if you choose, and moved in and out as Excel, Word or JSON.
Setup guide
Prefer to watch it?
The whole setup recorded, with chapters you can jump to: registering, your own domain, your own database in any of three places, your own mail server, branding, the first sign-in, updating the database on Supabase Cloud, and moving the database if you change your mind.
- 0:00 · Registering, signing in, and the free trial
- 0:44 · Your name and your firm’s name
- 0:50 · Custom domain
- +6 more