Remediation SLA Tracker
An open finding without a deadline never gets fixed. SLA-based vulnerability management puts a clock on every issue by severity — Critical in days, Low in months. Set your windows, add findings with the date they were discovered, and this tool computes each one's due date, days remaining and a RAG status, plus an overall compliance percentage you can take to a board. All the date math runs in your browser.
How the dates are computed
Due date = discovered date + the SLA window for that severity. Days remaining = due − a fixed "today" of 2026-10-24 (so the result is deterministic). Status is Breached once the due date has passed, At risk inside the last 20% of the window, and On track otherwise. Compliance % = findings not breached ÷ total. All math runs in your browser.
What this tool is
- A free, in-browser remediation SLA tracker: set an SLA window in days per severity (Critical / High / Medium / Low), add findings with a discovered date, and get the due date, days remaining and a RAG status for each.
- Due date = discovered date + the SLA window for that severity; days remaining is measured from a fixed "today" so results are deterministic and shareable.
- RAG status: Breached once the due date has passed, At risk in the final 20% of the window, On track otherwise — plus an overall SLA-compliance percentage.
- SLA-based vulnerability management sets a clock on every finding by severity, so the question stops being "is it fixed?" and becomes "will it be fixed in time?"
- All date math runs in your browser: no network calls, no secrets, no scanning — a defensive planning aid, not a live scanner.
Why this matters
"How are we doing on vulnerabilities?" is almost impossible to answer from a raw count that only ever grows. SLAs reframe the question around time: of everything we found, what share is being fixed inside the window we committed to? That single percentage is far more honest than open/closed counts, because it accounts for severity — a breached Critical is a real problem, a comfortably-on-track Low is not.
Tracking against SLAs also drives the right behavior: it surfaces the findings about to breach (At risk) before they do, so teams can act while there is still time, and it makes aging visible instead of letting old criticals quietly rot in the backlog. This tool gives you that view instantly and privately — set your policy, paste your findings, and read the clock. It is a planning and reporting aid, not a scanner.
Frequently asked questions
What is a remediation SLA in vulnerability management?
A remediation SLA (service-level agreement) is a committed time window to fix a vulnerability, set by severity. For example, a common policy is Critical within 7 days, High within 30, Medium within 90 and Low within 180. SLAs turn an open-ended backlog into a set of deadlines: every finding gets a clock the moment it is discovered, and the program is measured on whether fixes land inside those windows. This tool lets you set your own windows and see exactly where each finding stands against them.
How is the due date and status calculated?
The due date is the discovered date plus the SLA window for that finding’s severity. Days remaining is the due date minus a fixed reference "today" (shown in the tool), which keeps the numbers deterministic so the same input always gives the same result. The RAG status is derived from days remaining: Breached if the due date has already passed (negative days), At risk if you are within the last 20% of the window, and On track otherwise. The overall compliance percentage is the share of findings that are not breached.
What are typical SLA windows by severity?
There is no single standard, but a widely used starting point is Critical 7-15 days, High 30 days, Medium 90 days and Low 180 days, often tied to CVSS severity or to risk-based prioritization. Regulated environments and frameworks (PCI DSS, FedRAMP, internal risk policies) may impose tighter numbers — for example remediating internet-facing criticals in days. The windows in this tool are fully editable so you can model your own policy; nothing is hard-coded beyond the sensible defaults.
Does this connect to my scanner or ticketing system?
No. It is a 100% client-side tool: you enter findings and dates by hand (or load the sample set), and all the date arithmetic happens in your browser. There is no integration, no network call, no scanning and no secrets. It is an educational, defensive aid for planning and communicating SLA posture — export the table and feed it into your real tracker or a board report.
This tool is free and always will be. Would a Pro workspace — saved designs, team sharing and exports — be worth paying for?
Show me Pro →No account needed to use this tool — this just tells us whether Pro is worth building out.Educational — general guidance, not security advice.