In my post on Measuring and Reporting on Vulnerability Risk, I talked about how rankings and categories make for some easy to understand graphs, but they tend to fail at meaningfully measuring progress over time. Counting the numbers of highs, mediums and lows simply isnt an accurate a representation overall progress. If we focus on patching vulnerabilities, then the vulnerability count should go down, says tripwire.com.com. The vulnerability count is attractive as a means of measuring progress, or more importantly for communicating progress.”]
Source: https://informationsecuritybuzz.com/news/five-tips-for-measuring-progress-in-information-security/