Overview
Balbix provides multiple vulnerability trend widgets to help organizations understand how their security exposure changes over time.
The Active Vulnerabilities Trend widget in Balbix provides a time-based view of how the total number of active vulnerability instances changes from day to day. Customers often compare this widget with the New Vulnerabilities / Fixes Trend widget and expect the daily change in active vulnerabilities to equal the difference between New Vulnerabilities and Fixed Vulnerabilities.
In practice, these values frequently do not match. This is expected behavior.
This article explains:
The exact definition of each metric used in the Balbix trend widgets
All components that contribute to daily changes in active vulnerability counts
Why the Active Vulnerabilities will not generally equal (New Vulnerabilities – Fixed Vulnerabilities)
Key Concept: Vulnerability Instances
All metrics described in this article are calculated using vulnerability instances, not unique vulnerability identifiers (such as CVEs).
Example
If the same vulnerability affects 500 servers, Balbix counts this as 500 vulnerability instances, not 1 vulnerability.
As a result:
One vulnerability (for example, a CVE) can result in multiple instances of vulnerability across assets.
Changes in assets, integrations, or visibility can significantly impact instance counts, even when no “new” vulnerabilities are discovered.
Core Metrics
Active Vulnerabilities
The total number of active (unremediated) vulnerability instances on a given day. This is a daily snapshot of exposure, regardless of when vulnerabilities were first discovered.
New Exposures
Vulnerability instances observed for the first time on a given day.
Note
New refers to the first observation, not the publication date of a vulnerability.
Fixes
Vulnerability instances that were remediated on a given day.
Active Vulnerabilities Calculation
What Changed (Net Change)
The change in Active Vulnerabilities from one day to the next is calculated by comparing today’s active vulnerabilities with yesterday’s active vulnerabilities.
What changed = Today’s Active Vulnerabilities − Yesterday’s Active Vulnerabilities
This is the net change you see in the Active Vulnerabilities Trend.
Note
This is what customers see visually in the Active Vulnerabilities Trend.
Actual Drivers of Change
Actual Drivers of Change = New Exposures − Fixes + Exposures from Newly Un-Retired Assets − Exposures from Newly Retired Assets + Resurrected Exposures − Retired Exposures
Here are the details of each contributing factor:
New Exposures: Vulnerability instances observed for the first time on a given day.
Fixes: Vulnerability instances that were remediated on a given day.
Asset Un-Retirement: When previously retired assets reappear (for example, integration restored or asset re-enabled). All associated vulnerability instances return to the active count.
Asset Retirement: When assets are retired (for example, decommissioned servers or removed cloud resources). All vulnerability instances associated with those assets are removed from the active count.
Resurrected Vulnerabilities: These are vulnerability instances that were inactive on the previous day but are active today, retaining an older first_observed_at date. These are not new vulnerabilities, but they increase the active count.
Retired Vulnerabilities: These are vulnerability instances that are removed from the active count due to non-remediation reasons such as missing or stale data sources, temporary loss of scan coverage, or source de-duplication and normalization logic.
Why Active Vulnerabilities ≠ (New Exposures − Fixes)
It is expected and correct that:
Daily Change in Active Vulnerabilities ≠ New Exposures − Fixes
This is because New Exposures and Fixes represent only two of six contributors to the daily change. Asset lifecycle events, data source behavior, and visibility recovery can significantly affect the total.