{"id":2814,"date":"2026-10-31T02:20:00","date_gmt":"2026-10-31T02:20:00","guid":{"rendered":"https:\/\/www.surgeryplanet.com\/blog\/?p=2814"},"modified":"2026-10-31T02:20:00","modified_gmt":"2026-10-31T02:20:00","slug":"secops-nine-numbers-monthly","status":"publish","type":"post","link":"https:\/\/www.surgeryplanet.com\/blog\/secops-nine-numbers-monthly\/","title":{"rendered":"Nine SecOps Numbers Worth Reading Every Month"},"content":{"rendered":"<p>Anyone who has compared hospitals across borders knows the type: a brochure full of percentages that mean nothing until you ask &#8220;of what, measured how, and who counts the failures?&#8221; Security reporting has the same disease, and its usual symptom is one blended patch number on a slide. The working definition of <strong>SecOps<\/strong> used here \u2014 <a href=\"https:\/\/www.xopsschool.com\/secops\/\">the Atlas&#8217;s SecOps standard<\/a>, a working contract between security and operations \u2014 comes with a fairer scorecard. Below are the nine numbers it reads, illustrated with a real worked month that the Atlas documents, and each one passes a simple test: it has an owner, a cell, a deadline and a history. That test is worth applying to any figure anybody asks you to celebrate.<\/p>\n<h2>Why SecOps reports need better than one big percentage<\/h2>\n<p>NIST dismisses the single estate-wide patch percentage as a figure that is not actionable, and the reasoning is the same one that makes a hospital-wide satisfaction score nearly useless: averages bury the ward that needs help. A brochure percentage invites applause; a cell-level figure invites a decision. A number earns its place on a SecOps scorecard only if it passes four practical tests:<\/p>\n<ul>\n<li>it belongs to a cell \u2014 asset importance crossed with urgency \u2014 not to an average;<\/li>\n<li>it carries an owner&#8217;s name, not a department&#8217;s alias;<\/li>\n<li>it has a deadline that was resourced, meaning staff hours exist to meet it;<\/li>\n<li>it can be compared against last month without a footnote explaining why the definition changed.<\/li>\n<\/ul>\n<p>The worked example below is a single September at a mid-size estate, and it shows all nine numbers doing their job.<\/p>\n<h2>Nine numbers worth reading every SecOps month<\/h2>\n<h3>1. On-time percentage, per cell<\/h3>\n<p>The estate closed 198 of 240 findings on time that September \u2014 82.5 percent, a figure built to make a board feel warm. Per-cell, the warmth does not survive contact with the data, which is exactly the point of reading this number properly. Read it beside its cell sibling, never alone.<\/p>\n<h3>2. The cell the average was hiding<\/h3>\n<p>Internet-facing, high-severity findings: 95 percent on time. Datacentre, high-severity: 75 percent. The difference was not skill or budget but a missing change window \u2014 one team had a slot to work in, the other did not. No blended percentage can show that; the whole reason for per-cell reading is that a 7.5-point hole in your most sensitive cell deserves its own conversation, not a footnote inside a healthy-looking total. The remedy, in this case, cost one calendar decision rather than a rupee of new tooling.<\/p>\n<h3>3. Median time-to-remediate<\/h3>\n<p>The middle finding: how many days does the typical fix take, per cell. Medians resist the distortion of a few heroic overnight patches and a long tail of neglect. Read it per owner group, because &#8220;we are slow&#8221; is not fixable while &#8220;pharmacy assets wait nine days longer than web assets&#8221; is. Time-to-remediate is a per-cell duty, which is why this figure belongs next to the on-time percentage rather than instead of it.<\/p>\n<h3>4. p90 time-to-remediate<\/h3>\n<p>The ninth-decile figure shows the slowest tenth of fixes \u2014 where the queue actually jams. If the median looks tidy but p90 runs to months, the estate has a quiet pile of misery that only this number will confess to. Ask for the ten slowest register entries alongside it; nine times out of ten they share one owner or one site. Fixing p90 almost always means fixing one specific owner group&#8217;s capacity, which makes it the most actionable slow number on the page.<\/p>\n<h3>5. Findings with no owner<\/h3>\n<p>September&#8217;s register held 600 findings, of which 18 \u2014 3 percent \u2014 had no name attached. Three percent sounds forgiving until you remember that an unowned finding is one nobody is being paid to fix, and that the number trends in one direction unless someone is assigned to assign. Service desks that auto-route from the asset record keep this figure near zero; estates relying on goodwill watch it climb. This is the fastest read in the whole scorecard: one glance, and you know whether routing is working.<\/p>\n<h3>6. Exceptions past their review date<\/h3>\n<p>Six of 35 exceptions had lapsed \u2014 17 percent. Exceptions are accepted risks with expiry dates, and a lapsed one is a decision nobody has made recently. The health check is mechanical: pull every exception whose review date has passed, force a fresh yes or no \u2014 re-earn it or retire it. Estates that skip this slowly convert their exception list into an unmanaged second estate.<\/p>\n<h3>7. Telemetry coverage<\/h3>\n<p>The September count read 1,540 assets reporting out of 1,600 \u2014 96.25 percent. The 60 missing ones were an acquired subsidiary nobody had enrolled in scanning. Detection quality is capped by coverage, so this number caps every other number on the page; it is the denominator of trust. Read it before reading anything else, and read it per site, because subsidiaries, labs and newly merged offices are where coverage goes to hide.<\/p>\n<h3>8. Security-change disruptions<\/h3>\n<p>Out of 120 security changes, three caused disruption \u2014 2.5 percent \u2014 and every one of the three traced back to a single cause: an estate-wide baseline push that never saw a pilot ring. The counter keeps the hardening programme honest, the way a surgical site tracks its own complication rate rather than only its throughput. One disruption per change is not an argument against security work; it is an argument for the pilot ring somebody skipped. A team that reports this number monthly earns the credibility that keeps security changes welcome on the change calendar.<\/p>\n<h3>9. Closed tickets \u2014 read, never reward<\/h3>\n<p>Closed-ticket counts belong on the report and off the bonus scheme. Reward volume and people close the easy tickets while the internet-facing queue starves; every practised reader of scorecards has seen it happen. Read the count to understand workload. Never let it become the goal, or the ninth number will quietly eat the other eight.<\/p>\n<h2>What a SecOps scorecard borrows from patient checklists<\/h2>\n<p>The habits behind these nine numbers will feel familiar to anyone who has vetted care abroad: verified credentials, dated records, and a named professional accountable at every step \u2014 the same logic as <a href=\"https:\/\/www.surgeryplanet.com\/blog\/the-smart-patients-guide-to-checking-hospital-accreditation-abroad\/\">checking a hospital&#8217;s accreditation ahead of treatment abroad<\/a>. Machines in a fleet are vetted the same way, unit by unit, as the guide to <a href=\"https:\/\/www.surgeryplanet.com\/blog\/understanding-the-basics-of-robotic-fleet-management\/\">robotic fleet management basics<\/a> describes. And for readers who want the wider operations frame these figures sit in, the <a href=\"https:\/\/www.surgeryplanet.com\/blog\/understanding-xops-the-modern-framework-for-connected-it-operations-learning-paths-and-tools\/\">modern framework for connected IT operations<\/a> maps the neighbouring disciplines. The practical takeaway fits in a notebook: bin the blended percentage, keep the nine, and make one person read them aloud in the same meeting every month. Scorecards do not fix estates; named readers with resourced deadlines do \u2014 which is the whole of SecOps, nine numbers at a time.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>One blended patch percentage hides the cell that needs help. Nine SecOps numbers replace it \u2014 each with an owner, a cell, a deadline and a history.<\/p>\n","protected":false},"author":13,"featured_media":2815,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1583],"tags":[],"class_list":["post-2814","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-medical-tourism-insights"],"_links":{"self":[{"href":"https:\/\/www.surgeryplanet.com\/blog\/wp-json\/wp\/v2\/posts\/2814","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.surgeryplanet.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.surgeryplanet.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.surgeryplanet.com\/blog\/wp-json\/wp\/v2\/users\/13"}],"replies":[{"embeddable":true,"href":"https:\/\/www.surgeryplanet.com\/blog\/wp-json\/wp\/v2\/comments?post=2814"}],"version-history":[{"count":1,"href":"https:\/\/www.surgeryplanet.com\/blog\/wp-json\/wp\/v2\/posts\/2814\/revisions"}],"predecessor-version":[{"id":2819,"href":"https:\/\/www.surgeryplanet.com\/blog\/wp-json\/wp\/v2\/posts\/2814\/revisions\/2819"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.surgeryplanet.com\/blog\/wp-json\/wp\/v2\/media\/2815"}],"wp:attachment":[{"href":"https:\/\/www.surgeryplanet.com\/blog\/wp-json\/wp\/v2\/media?parent=2814"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.surgeryplanet.com\/blog\/wp-json\/wp\/v2\/categories?post=2814"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.surgeryplanet.com\/blog\/wp-json\/wp\/v2\/tags?post=2814"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}