---
title: "Understanding Vulnerability Trend Metrics"
slug: "understanding-vulnerability-trend-metrics"
updated: 2026-10-22T15:02:28Z
published: 2026-10-22T15:02:28Z
canonical: "docs.safe.security/understanding-vulnerability-trend-metrics"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.safe.security/llms.txt
> Use this file to discover all available pages before exploring further.

# Understanding Vulnerability Trend Metrics

## Overview

Balbix provides multiple vulnerability trend widgets to help organizations understand how their security exposure changes over time.

The Active Vulnerabilities Trend widget in Balbix provides a time-based view of how the total number of active vulnerability instances changes from day to day. Customers often compare this widget with the New Vulnerabilities / Fixes Trend widget and expect the daily change in **active vulnerabilities to equal the difference between New Vulnerabilities and Fixed Vulnerabilities.**

In practice, these values frequently do not match. This is expected behavior.

This article explains:

- The exact definition of each metric used in the Balbix trend widgets
- All components that contribute to daily changes in active vulnerability counts
- Why the Active Vulnerabilities will not generally equal (New Vulnerabilities – Fixed Vulnerabilities)

## Key Concept: Vulnerability Instances

All metrics described in this article are calculated using vulnerability instances, not unique vulnerability identifiers (such as CVEs).

**Example**

If the same vulnerability affects 500 servers, Balbix counts this as 500 vulnerability instances, not 1 vulnerability.

**As a result:**

- One vulnerability (for example, a CVE) can result in multiple instances of vulnerability across assets.
- Changes in assets, integrations, or visibility can significantly impact instance counts, even when no “new” vulnerabilities are discovered.

## Core Metrics

**Active Vulnerabilities**

The total number of active (unremediated) vulnerability instances on a given day. This is a daily snapshot of exposure, regardless of when vulnerabilities were first discovered.

**New Exposures**

Vulnerability instances observed for the first time on a given day.

> [!WARNING]
> Note
> 
> New refers to the first observation, not the publication date of a vulnerability.

**Fixes**

Vulnerability instances that were remediated on a given day.

## Active Vulnerabilities Calculation

**What Changed (Net Change)**

The change in Active Vulnerabilities from one day to the next is calculated by comparing today’s active vulnerabilities with yesterday’s active vulnerabilities.

**What changed = Today’s Active Vulnerabilities** − **Yesterday’s Active Vulnerabilities**

This is the net change you see in the Active Vulnerabilities Trend.

> [!WARNING]
> Note
> 
> This is what customers see visually in the Active Vulnerabilities Trend.

**Actual Drivers of Change**

**Actual Drivers of Change = New Exposures** − **Fixes** + **Exposures from Newly Un-Retired Assets** − **Exposures from Newly Retired Assets** + **Resurrected Exposures** − **Retired Exposures**

Here are the details of each contributing factor:

1. **New Exposures**: Vulnerability instances observed for the first time on a given day.
2. **Fixes**: Vulnerability instances that were remediated on a given day.
3. **Asset Un-Retirement**: When previously retired assets reappear (for example, integration restored or asset re-enabled). All associated vulnerability instances return to the active count.
4. **Asset Retirement**: When assets are retired (for example, decommissioned servers or removed cloud resources). All vulnerability instances associated with those assets are removed from the active count.
5. **Resurrected Vulnerabilities**: These are vulnerability instances that were inactive on the previous day but are active today, retaining an older first_observed_at date. These are not new vulnerabilities, but they increase the active count.
6. **Retired Vulnerabilities:** These are vulnerability instances that are removed from the active count due to non-remediation reasons such as missing or stale data sources, temporary loss of scan coverage, or source de-duplication and normalization logic.

## Why Active Vulnerabilities ≠ (New Exposures − Fixes)

It is expected and correct that:

**Daily Change in Active Vulnerabilities ≠ New Exposures − Fixes**

This is because New Exposures and Fixes represent **only two of six contributors to the daily change**. Asset lifecycle events, data source behavior, and visibility recovery can significantly affect the total.